Vulnerability database

5,700 results · page 36 of 114

• Sep 22, 2025MakeStories (for Google Web Stories): Server-Side Request Forgery (SSRF)CVE-2025-57984 · WordPress plugins & themes · reported by PatchstackMedium 4.4

  Server-Side Request Forgery (SSRF) vulnerability in Pratik Ghela MakeStories (for Google Web Stories) makestories-helper allows Server Side Request Forgery.This issue affects MakeStories (for Google Web Stories): from n/a through <= 3.0.4.

  Product

  MakeStories (for Google Web Stories)

  Affected

  up to 3.0.4

  What to do

  Affects up to 3.0.4. Update MakeStories (for Google Web Stories) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025BP Disable Activation Reloaded: Cross-Site Request Forgery (CSRF)CVE-2025-57983 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Cross-Site Request Forgery (CSRF) vulnerability in Damian BP Disable Activation Reloaded bp-disable-activation-reloaded allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects BP Disable Activation Reloaded: from n/a through <= 1.2.1.

  Product

  BP Disable Activation Reloaded

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update BP Disable Activation Reloaded to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Advanced Appointment Booking & Scheduling: Cross-Site Request Forgery (CSRF)CVE-2025-57978 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in themespride Advanced Appointment Booking & Scheduling advanced-appointment-booking-scheduling allows Cross Site Request Forgery.This issue affects Advanced Appointment Booking & Scheduling: from n/a through <= 2.1.

  Product

  Advanced Appointment Booking & Scheduling

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update Advanced Appointment Booking & Scheduling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Flexible PDF Invoices for WooCommerce &: Cross-Site Request Forgery (CSRF)CVE-2025-57977 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in wpdesk Flexible PDF Invoices for WooCommerce & WordPress flexible-invoices allows Cross Site Request Forgery.This issue affects Flexible PDF Invoices for WooCommerce & WordPress: from n/a through <= 6.0.13.

  Product

  Flexible PDF Invoices for WooCommerce &

  Affected

  up to 6.0.13

  What to do

  Affects up to 6.0.13. Update Flexible PDF Invoices for WooCommerce & to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025SALESmanago & Leadoo: Cross-Site Request Forgery (CSRF)CVE-2025-57970 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in SALESmanago SALESmanago & Leadoo salesmanago allows Cross Site Request Forgery.This issue affects SALESmanago & Leadoo: from n/a through <= 3.8.1.

  Product

  SALESmanago & Leadoo

  Affected

  up to 3.8.1

  What to do

  Affects up to 3.8.1. Update SALESmanago & Leadoo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Travel Map: Cross-Site Request Forgery (CSRF)CVE-2025-57960 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in TravelMap Travel Map travelmap-blog allows Cross Site Request Forgery.This issue affects Travel Map: from n/a through <= 1.0.3.

  Product

  Travel Map

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update Travel Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025payOS: Cross-Site Request Forgery (CSRF)CVE-2025-57946 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Loc Bui payOS payos allows Cross Site Request Forgery.This issue affects payOS: from n/a through <= 1.0.73.

  Product

  payOS

  Affected

  up to 1.0.73

  What to do

  Affects up to 1.0.73. Update payOS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Skimlinks Affiliate Marketing Tool: Server-Side Request Forgery (SSRF)CVE-2025-57943 · WordPress plugins & themes · reported by PatchstackMedium 4.4

  Server-Side Request Forgery (SSRF) vulnerability in Skimlinks Skimlinks Affiliate Marketing Tool skimlinks allows Server Side Request Forgery.This issue affects Skimlinks Affiliate Marketing Tool: from n/a through <= 1.3.1.

  Product

  Skimlinks Affiliate Marketing Tool

  Affected

  up to 1.3.1

  What to do

  Affects up to 1.3.1. Update Skimlinks Affiliate Marketing Tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Emergency Password Reset: Cross-Site Request Forgery (CSRF)CVE-2025-57942 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in andy_moyle Emergency Password Reset emergency-password-reset allows Cross Site Request Forgery.This issue affects Emergency Password Reset: from n/a through <= 9.3.

  Product

  Emergency Password Reset

  Affected

  up to 9.3

  What to do

  Affects up to 9.3. Update Emergency Password Reset to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025LWS Affiliation: Cross-Site Request Forgery (CSRF)CVE-2025-57934 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Aurélien LWS LWS Affiliation lws-affiliation allows Cross Site Request Forgery.This issue affects LWS Affiliation: from n/a through <= 2.3.6.

  Product

  LWS Affiliation

  Affected

  up to 2.3.6

  What to do

  Affects up to 2.3.6. Update LWS Affiliation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Piotnet Forms: Cross-Site Request Forgery (CSRF)CVE-2025-57933 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in piotnetdotcom Piotnet Forms piotnetforms allows Cross Site Request Forgery.This issue affects Piotnet Forms: from n/a through <= 1.0.30.

  Product

  Piotnet Forms

  Affected

  up to 1.0.30

  What to do

  Affects up to 1.0.30. Update Piotnet Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Double the Donation: Cross-Site Request Forgery (CSRF)CVE-2025-57930 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in kanwei_doublethedonation Double the Donation double-the-donation allows Cross Site Request Forgery.This issue affects Double the Donation: from n/a through <= 2.0.0.

  Product

  Double the Donation

  Affected

  up to 2.0.0

  What to do

  Affects up to 2.0.0. Update Double the Donation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Dashboard Notepad: Cross-Site Request Forgery (CSRF)CVE-2025-57927 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Stephanie Leary Dashboard Notepad dashboard-notepad allows Cross Site Request Forgery.This issue affects Dashboard Notepad: from n/a through <= 1.42.

  Product

  Dashboard Notepad

  Affected

  up to 1.42

  What to do

  Affects up to 1.42. Update Dashboard Notepad to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025immonex Kickstart Team: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-57925 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in immonex immonex Kickstart Team immonex-kickstart-team allows PHP Local File Inclusion.This issue affects immonex Kickstart Team: from n/a through <= 1.6.9.

  Product

  immonex Kickstart Team

  Affected

  up to 1.6.9

  What to do

  Affects up to 1.6.9. Update immonex Kickstart Team to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Developer: Cross-Site Request Forgery (CSRF)CVE-2025-57924 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Automattic Developer allows Cross Site Request Forgery. This issue affects Developer: from n/a through 1.2.6.

  Product

  Developer

  Affected

  up to 1.2.6

  What to do

  Affects up to 1.2.6. Update Developer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025LinkedInclude: Cross-Site Request Forgery (CSRF)CVE-2025-57918 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in ERA404 LinkedInclude linkedinclude allows Stored XSS.This issue affects LinkedInclude: from n/a through <= 3.0.4.

  Product

  LinkedInclude

  Affected

  up to 3.0.4

  What to do

  Affects up to 3.0.4. Update LinkedInclude to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025TOCHAT.BE: Cross-Site Request Forgery (CSRF)CVE-2025-57915 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in César Martín TOCHAT.BE tochat-be allows Cross Site Request Forgery.This issue affects TOCHAT.BE: from n/a through <= 1.3.4.

  Product

  TOCHAT.BE

  Affected

  up to 1.3.4

  What to do

  Affects up to 1.3.4. Update TOCHAT.BE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Deliver via Shipos for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-57914 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Matat Technologies Deliver via Shipos for WooCommerce wc-shipos-delivery allows Cross Site Request Forgery.This issue affects Deliver via Shipos for WooCommerce: from n/a through <= 3.0.2.

  Product

  Deliver via Shipos for WooCommerce

  Affected

  up to 3.0.2

  What to do

  Affects up to 3.0.2. Update Deliver via Shipos for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025AgreeMe Checkboxes For WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-57905 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Amin Y AgreeMe Checkboxes For WooCommerce agreeme-checkboxes-for-woocommerce allows Cross Site Request Forgery.This issue affects AgreeMe Checkboxes For WooCommerce: from n/a through <= 1.1.3.

  Product

  AgreeMe Checkboxes For WooCommerce

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update AgreeMe Checkboxes For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025RIS Version Switcher – Downgrade or Upgrade WP Versions Easily: Cross-Site Request Forgery (CSRF)CVE-2025-57902 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Cross-Site Request Forgery (CSRF) vulnerability in Md Taufiqur Rahman RIS Version Switcher – Downgrade or Upgrade WP Versions Easily ris-version-switcher allows Cross Site Request Forgery.This issue affects RIS Version Switcher – Downgrade or Upgrade WP Versions Easily: from n/a through <= 1.0.

  Product

  RIS Version Switcher – Downgrade or Upgrade WP Versions Easily

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update RIS Version Switcher – Downgrade or Upgrade WP Versions Easily to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Beaf: Server-Side Request Forgery (SSRF)CVE-2025-53461 · WordPress plugins & themes · reported by PatchstackMedium 4.4

  Server-Side Request Forgery (SSRF) vulnerability in Binsaifullah Beaf image-compare-block allows Server Side Request Forgery.This issue affects Beaf: from n/a through <= 1.6.2.

  Product

  Beaf

  Affected

  up to 1.6.2

  What to do

  Affects up to 1.6.2. Update Beaf to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025SEO Backlink Monitor: Server-Side Request Forgery (SSRF)CVE-2025-53457 · WordPress plugins & themes · reported by PatchstackMedium 4.4

  Server-Side Request Forgery (SSRF) vulnerability in activewebsight SEO Backlink Monitor seo-backlink-monitor allows Server Side Request Forgery.This issue affects SEO Backlink Monitor: from n/a through <= 1.8.0.

  Product

  SEO Backlink Monitor

  Affected

  up to 1.8.0

  What to do

  Affects up to 1.8.0. Update SEO Backlink Monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025SEO Backlink Monitor: Cross-Site Request Forgery (CSRF)CVE-2025-53456 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in activewebsight SEO Backlink Monitor seo-backlink-monitor allows Cross Site Request Forgery.This issue affects SEO Backlink Monitor: from n/a through <= 1.8.0.

  Product

  SEO Backlink Monitor

  Affected

  up to 1.8.0

  What to do

  Affects up to 1.8.0. Update SEO Backlink Monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Mihdan: No External Links: Cross-Site Request Forgery (CSRF)CVE-2025-53451 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in mihdan Mihdan: No External Links mihdan-no-external-links allows Cross Site Request Forgery.This issue affects Mihdan: No External Links: from n/a through <= 5.1.6.2.

  Product

  Mihdan: No External Links

  Affected

  up to 5.1.6.2

  What to do

  Affects up to 5.1.6.2. Update Mihdan: No External Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Easy Pricing Table WP: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-53450 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Pluginwale Easy Pricing Table WP easy-pricing-table-wp allows PHP Local File Inclusion.This issue affects Easy Pricing Table WP: from n/a through <= 1.1.3.

  Product

  Easy Pricing Table WP

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update Easy Pricing Table WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 22, 2025Etsy Shop: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2025-9115 · WordPress plugins & themes · reported by WPScanMedium 5.6

  The Etsy Shop WordPress plugin before 3.0.7 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers.

  Product

  Etsy Shop

  Fixed in

  3.0.7

  What to do

  Update Etsy Shop to 3.0.7 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 20, 2025Custom Login And Signup Widget: Cross-Site Request ForgeryCVE-2025-9887 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Custom Login And Signup Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation in the /frndzk_adminclsw.php file. This makes it possible for unauthenticated attackers to change the email and username settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  Custom Login And Signup Widget

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Custom Login And Signup Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Sep 20, 2025Browser Sniff: Cross-Site Request ForgeryCVE-2025-9883 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The Browser Sniff plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  Browser Sniff

  Affected

  up to 2.3

  What to do

  Affects up to 2.3. Update Browser Sniff to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org

• Sep 20, 2025osTicket WP Bridge: Cross-Site Request ForgeryCVE-2025-9882 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The osTicket WP Bridge plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.2. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  osTicket WP Bridge

  Affected

  up to 1.9.2

  What to do

  Affects up to 1.9.2. Update osTicket WP Bridge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org

• Sep 20, 2025Internal Links Manager: Cross-Site Request ForgeryCVE-2025-9949 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Internal Links Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.1. This is due to missing or incorrect nonce validation on the link deletion functionality in the process_bulk_action() function. This makes it possible for unauthenticated attackers to delete SEO links via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  Internal Links Manager

  Affected

  up to 3.0.1

  What to do

  Affects up to 3.0.1. Update Internal Links Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org

• Sep 17, 2025The Hack Repair Guy's Plugin Archiver: Cross-Site Request ForgeryCVE-2025-10188 · WordPress plugins & themes · reported by WordfenceMedium 5.4

  The The Hack Repair Guy's Plugin Archiver plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.4. This is due to missing or incorrect nonce validation on the bulk_remove() function. This makes it possible for unauthenticated attackers to arbitrary directory deletion in /wp-content via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  The Hack Repair Guy's Plugin Archiver

  Affected

  up to 2.0.4

  What to do

  Affects up to 2.0.4. Update The Hack Repair Guy's Plugin Archiver to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Sep 16, 2025User Sync – Remote User Sync: Cross-Site Request ForgeryCVE-2025-9891 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The User Sync – Remote User Sync plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to missing or incorrect nonce validation on the mo_user_sync_form_handler() function. This makes it possible for unauthenticated attackers to deactivate the plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  User Sync – Remote User Sync

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update User Sync – Remote User Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 16, 2025USS Upyun: Cross-Site Request ForgeryCVE-2025-9629 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The USS Upyun plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.0. This is due to missing or incorrect nonce validation on the uss_setting_page function when processing the uss_set form type. This makes it possible for unauthenticated attackers to modify critical Upyun cloud storage settings including bucket name, operator credentials, upload paths, and image processing parameters via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  USS Upyun

  Affected

  up to 1.5.0

  What to do

  Affects up to 1.5.0. Update USS Upyun to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 12, 2025Contact Form 7 reCAPTCHA: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2025-8280 · WordPress plugins & themes · reported by WPScanMedium 5.8

  The Contact Form 7 reCAPTCHA WordPress plugin through 1.2.0 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers.

  Product

  Contact Form 7 reCAPTCHA

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update Contact Form 7 reCAPTCHA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Sep 12, 2025Ultimate Blogroll: Cross-Site Request ForgeryCVE-2025-9881 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The Ultimate Blogroll plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.2. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  Ultimate Blogroll

  Affected

  up to 2.5.2

  What to do

  Affects up to 2.5.2. Update Ultimate Blogroll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org

• Sep 12, 2025Side Slide Responsive Menu: Cross-Site Request ForgeryCVE-2025-9880 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The Side Slide Responsive Menu plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  Side Slide Responsive Menu

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Side Slide Responsive Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 11, 2025Analytics Reduce Bounce Rate: Cross-Site Request ForgeryCVE-2025-9635 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Analytics Reduce Bounce Rate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3. This is due to missing or incorrect nonce validation on the unbounce_options function. This makes it possible for unauthenticated attackers to modify Google Analytics tracking settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  Analytics Reduce Bounce Rate

  Affected

  up to 2.3

  What to do

  Affects up to 2.3. Update Analytics Reduce Bounce Rate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 11, 2025Plugin updates blocker: Cross-Site Request ForgeryCVE-2025-9634 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Plugin updates blocker plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2. This is due to missing or incorrect nonce validation on the pub_save action handler. This makes it possible for unauthenticated attackers to disable or enable plugin updates via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  Plugin updates blocker

  Affected

  up to 0.2

  What to do

  Affects up to 0.2. Update Plugin updates blocker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Sep 11, 2025LH Signing: Cross-Site Request ForgeryCVE-2025-9633 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The LH Signing plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.83. This is due to missing or incorrect nonce validation on the plugin_options function. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  LH Signing

  Affected

  up to 2.83

  What to do

  Affects up to 2.83. Update LH Signing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 11, 2025PhpList Subber: Cross-Site Request ForgeryCVE-2025-9632 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The PhpList Subber plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on the bulk_action_handler function. This makes it possible for unauthenticated attackers to trigger bulk synchronization of subscription forms via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  PhpList Subber

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update PhpList Subber to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 11, 2025AutoCatSet: Cross-Site Request ForgeryCVE-2025-9631 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The AutoCatSet plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.4. This is due to missing or incorrect nonce validation on the autocatset_ajax function. This makes it possible for unauthenticated attackers to trigger automatic recategorization of posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  AutoCatSet

  Affected

  up to 2.1.4

  What to do

  Affects up to 2.1.4. Update AutoCatSet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 11, 2025The integration of the AMO.CRM: Cross-Site Request ForgeryCVE-2025-9628 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The The integration of the AMO.CRM plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the settings_page function. This makes it possible for unauthenticated attackers to modify critical API connection settings including the AMO.CRM API URL, login credentials, and API hash key via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  The integration of the AMO.CRM

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update The integration of the AMO.CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 11, 2025Run Log: Cross-Site Request ForgeryCVE-2025-9627 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Run Log plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.10. This is due to missing or incorrect nonce validation on the oirl_plugin_options function. This makes it possible for unauthenticated attackers to modify plugin settings including distance units, pace display preferences, style themes, and display positions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  Run Log

  Affected

  up to 1.7.10

  What to do

  Affects up to 1.7.10. Update Run Log to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 11, 2025Admin in English with Switch: Cross-Site Request ForgeryCVE-2025-9623 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Admin in English with Switch plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on the enable_eng function. This makes it possible for unauthenticated attackers to modify administrator language settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  Admin in English with Switch

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Admin in English with Switch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 11, 2025Seo Monster: Cross-Site Request ForgeryCVE-2025-9620 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The Seo Monster plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.3. This is due to missing or incorrect nonce validation on the check_integration() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  Seo Monster

  Affected

  up to 3.3.3

  What to do

  Affects up to 3.3.3. Update Seo Monster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 11, 2025Publish approval: Cross-Site Request ForgeryCVE-2025-9617 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The Publish approval plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on the publish_save_option function. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  Publish approval

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Publish approval to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Sep 11, 2025Blog Designer For Elementor – Post Slider, Post Carousel, Post Grid: Cross-Site Request Forgery in version 1CVE-2025-8481 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Blog Designer For Elementor – Post Slider, Post Carousel, Post Grid plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.1.7. This is due to missing or incorrect nonce validation on the bdfe_install_activate_rswpbs_only function. This makes it possible for unauthenticated attackers to install the 'rs-wp-books-showcase' plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  Blog Designer For Elementor – Post Slider, Post Carousel, Post Grid

  What to do

  Update Blog Designer For Elementor – Post Slider, Post Carousel, Post Grid to the newest version.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Sep 11, 2025Zoho Flow: Cross-Site Request ForgeryCVE-2025-8479 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Zoho Flow plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.14.1. This is due to missing or incorrect nonce validation on the zoho_flow_deactivate_plugin function. This makes it possible for unauthenticated attackers to modify typography settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  Zoho Flow

  Affected

  up to 2.14.1

  What to do

  Affects up to 2.14.1. Update Zoho Flow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 10, 2025Maspik – Ultimate Spam Protection: Cross-Site Request ForgeryCVE-2025-9888 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Maspik – Ultimate Spam Protection plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.6. This is due to missing or incorrect nonce validation on the clear_log function. This makes it possible for unauthenticated attackers to clear all spam logs via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  Maspik – Ultimate Spam Protection

  Affected

  up to 2.5.6

  What to do

  Affects up to 2.5.6. Update Maspik – Ultimate Spam Protection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 10, 2025WP Blast | SEO & Performance Booster: Cross-Site Request ForgeryCVE-2025-9622 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The WP Blast | SEO & Performance Booster plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.6. This is due to missing or incorrect nonce validation on multiple administrative actions in the Settings class. This makes it possible for unauthenticated attackers to trigger cache purging, sitemap clearing, plugin data purging, and score resetting operations via forged requests granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  WP Blast | SEO & Performance Booster

  Affected

  up to 1.8.6

  What to do

  Affects up to 1.8.6. Update WP Blast | SEO & Performance Booster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.