Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
41,498 results · page 369 of 830
Apr 17, 2025Ultimate Store Kit Elementor Addons: Deserialization of Untrusted DataCVE-2025-39588 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in bdthemes Ultimate Store Kit Elementor Addons ultimate-store-kit allows Object Injection.This issue affects Ultimate Store Kit Elementor Addons: from n/a through <= 2.4.0.
- Product
- Ultimate Store Kit Elementor Addons
- Affected
- up to 2.4.0
- What to do
- Affects up to 2.4.0. Update Ultimate Store Kit Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Cost Calculator Builder: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-39587 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix Cost Calculator Builder cost-calculator-builder allows SQL Injection.This issue affects Cost Calculator Builder: from n/a through <= 3.2.65.
- Product
- Cost Calculator Builder
- Affected
- up to 3.2.65
- What to do
- Affects up to 3.2.65. Update Cost Calculator Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025ProfileGrid: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-39586 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows SQL Injection.This issue affects ProfileGrid : from n/a through <= 5.9.4.8.
- Product
- ProfileGrid
- Affected
- up to 5.9.4.8
- What to do
- Affects up to 5.9.4.8. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025BERTHA AI: Missing AuthorizationCVE-2025-39583 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in Bertha AI – Andrew Palmer BERTHA AI bertha-ai-free allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BERTHA AI: from n/a through <= 1.12.10.2.
- Product
- BERTHA AI
- Affected
- up to 1.12.10.2
- What to do
- Affects up to 1.12.10.2. Update BERTHA AI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Dashi: Missing AuthorizationCVE-2025-39580 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Missing Authorization vulnerability in jidaikobo Dashi dashi allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Dashi: from n/a through <= 3.1.8.
- Product
- Dashi
- Affected
- up to 3.1.8
- What to do
- Affects up to 3.1.8. Update Dashi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Taskbuilder: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-39569 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in taskbuilder Taskbuilder taskbuilder allows Blind SQL Injection.This issue affects Taskbuilder: from n/a through <= 4.0.1.
- Product
- Taskbuilder
- Affected
- up to 4.0.1
- What to do
- Affects up to 4.0.1. Update Taskbuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025StoreContrl Woocommerce: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-39568 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Arture B.V. StoreContrl Woocommerce storecontrl-wp-connection allows Path Traversal.This issue affects StoreContrl Woocommerce: from n/a through <= 4.1.3.
- Product
- StoreContrl Woocommerce
- Affected
- up to 4.1.3
- What to do
- Affects up to 4.1.3. Update StoreContrl Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Web Directory Free: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39567 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shamalli Web Directory Free web-directory-free allows Reflected XSS.This issue affects Web Directory Free: from n/a through <= 1.7.8.
- Product
- Web Directory Free
- Affected
- up to 1.7.8
- What to do
- Affects up to 1.7.8. Update Web Directory Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Payment Form for PayPal Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39562 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Payment Form for PayPal Pro payment-form-for-paypal-pro allows Stored XSS.This issue affects Payment Form for PayPal Pro: from n/a through <= 1.1.72.
- Product
- Payment Form for PayPal Pro
- Affected
- up to 1.1.72
- What to do
- Affects up to 1.1.72. Update Payment Form for PayPal Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Bring Fraktguiden for WooCommerce: Missing AuthorizationCVE-2025-39559 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Eivin Landa Bring Fraktguiden for WooCommerce bring-fraktguiden-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bring Fraktguiden for WooCommerce: from n/a through <= 1.11.4.
- Product
- Bring Fraktguiden for WooCommerce
- Affected
- up to 1.11.4
- What to do
- Affects up to 1.11.4. Update Bring Fraktguiden for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025CRM Perks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39558 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks CRM Perks support-x allows Reflected XSS.This issue affects CRM Perks: from n/a through <= 1.1.7.
- Product
- CRM Perks
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update CRM Perks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025AI Text to Speech: Missing AuthorizationCVE-2025-39554 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Elliot Sowersby / RelyWP AI Text to Speech ai-text-to-speech allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Text to Speech: from n/a through <= 3.0.3.
- Product
- AI Text to Speech
- Affected
- up to 3.0.3
- What to do
- Affects up to 3.0.3. Update AI Text to Speech to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025FluentBoards: Deserialization of Untrusted DataCVE-2025-39551 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Mahmudul Hasan Arif FluentBoards fluent-boards allows Object Injection.This issue affects FluentBoards: from n/a through <= 1.47.
- Product
- FluentBoards
- Affected
- up to 1.47
- What to do
- Affects up to 1.47. Update FluentBoards to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025FluentCommunity: Deserialization of Untrusted DataCVE-2025-39550 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Shahjahan Jewel FluentCommunity fluent-community allows Object Injection.This issue affects FluentCommunity: from n/a through <= 1.2.15.
- Product
- FluentCommunity
- Affected
- up to 1.2.15
- What to do
- Affects up to 1.2.15. Update FluentCommunity to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Xelion Webchat: Incorrect Privilege AssignmentCVE-2025-39542 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in Jauhari Xelion Xelion Webchat xelion-webchat allows Privilege Escalation.This issue affects Xelion Webchat: from n/a through <= 9.1.0.
- Product
- Xelion Webchat
- Affected
- up to 9.1.0
- What to do
- Affects up to 9.1.0. Update Xelion Webchat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Vitepos: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-39535 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Authentication Bypass Using an Alternate Path or Channel vulnerability in appsbd Vitepos vitepos-lite allows Authentication Abuse.This issue affects Vitepos: from n/a through <= 3.1.7.
- Product
- Vitepos
- Affected
- up to 3.1.7
- What to do
- Affects up to 3.1.7. Update Vitepos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Starfish Review Generation & Marketing: Missing AuthorizationCVE-2025-39533 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in Starfish Reviews Starfish Review Generation & Marketing starfish-reviews allows Privilege Escalation.This issue affects Starfish Review Generation & Marketing: from n/a through <= 3.1.19.
- Product
- Starfish Review Generation & Marketing
- Affected
- up to 3.1.19
- What to do
- Affects up to 3.1.19. Update Starfish Review Generation & Marketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Spice Blocks: Missing AuthorizationCVE-2025-39532 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in spicethemes Spice Blocks spice-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spice Blocks: from n/a through <= 2.0.7.7.
- Product
- Spice Blocks
- Affected
- up to 2.0.7.7
- What to do
- Affects up to 2.0.7.7. Update Spice Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Rating by BestWebSoft: Deserialization of Untrusted DataCVE-2025-39527 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in bestweblayout Rating by BestWebSoft rating-bws allows Object Injection.This issue affects Rating by BestWebSoft: from n/a through <= 1.7.
- Product
- Rating by BestWebSoft
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Rating by BestWebSoft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Hotel Booking: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39526 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in nicdark Hotel Booking nd-booking allows PHP Local File Inclusion.This issue affects Hotel Booking: from n/a through <= 3.6.
- Product
- Hotel Booking
- Affected
- up to 3.6
- What to do
- Affects up to 3.6. Update Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Contact Form vCard Generator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39521 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ashish Ajani Contact Form vCard Generator contact-form-vcard-generator allows Reflected XSS.This issue affects Contact Form vCard Generator: from n/a through <= 2.4.
- Product
- Contact Form vCard Generator
- Affected
- up to 2.4
- What to do
- Affects up to 2.4. Update Contact Form vCard Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Bulk Page Stub Creator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39519 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in runthings.dev Bulk Page Stub Creator bulk-page-stub-creator allows Reflected XSS.This issue affects Bulk Page Stub Creator: from n/a through <= 1.1.
- Product
- Bulk Page Stub Creator
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Bulk Page Stub Creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025AdminQuickbar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39464 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rtowebsites AdminQuickbar adminquickbar allows Reflected XSS.This issue affects AdminQuickbar: from n/a through <= 1.9.1.
- Product
- AdminQuickbar
- Affected
- up to 1.9.1
- What to do
- Affects up to 1.9.1. Update AdminQuickbar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Smart Agreements: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39462 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in teamzt Smart Agreements smart-agreements allows PHP Local File Inclusion.This issue affects Smart Agreements: from n/a through <= 1.0.3.
- Product
- Smart Agreements
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Smart Agreements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Docket Cache: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39461 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Nawawi Jamili Docket Cache docket-cache allows PHP Local File Inclusion.This issue affects Docket Cache: from n/a through <= 24.07.02.
- Product
- Docket Cache
- Affected
- up to 24.07.02
- What to do
- Affects up to 24.07.02. Update Docket Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Booking and Rental Manager: Missing AuthorizationCVE-2025-39457 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking and Rental Manager: from n/a through <= 2.2.8.
- Product
- Booking and Rental Manager
- Affected
- up to 2.2.8
- What to do
- Affects up to 2.2.8. Update Booking and Rental Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025WP Logger: Missing AuthorizationCVE-2025-39456 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in iTRON WP Logger wp-data-logger allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Logger: from n/a through <= 2.2.
- Product
- WP Logger
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update WP Logger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025IP2Location Variables: Cross-Site Request Forgery (CSRF)CVE-2025-39455 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in IP2Location IP2Location Variables ip2location-variables allows Reflected XSS.This issue affects IP2Location Variables: from n/a through <= 2.9.5.
- Product
- IP2Location Variables
- Affected
- up to 2.9.5
- What to do
- Affects up to 2.9.5. Update IP2Location Variables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Advanced Dynamic Pricing for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-39453 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in algol.plus Advanced Dynamic Pricing for WooCommerce advanced-dynamic-pricing-for-woocommerce allows Cross Site Request Forgery.This issue affects Advanced Dynamic Pricing for WooCommerce: from n/a through <= 4.9.3.
- Product
- Advanced Dynamic Pricing for WooCommerce
- Affected
- up to 4.9.3
- What to do
- Affects up to 4.9.3. Update Advanced Dynamic Pricing for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025WPCafe: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39452 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Arraytics WPCafe wp-cafe allows PHP Local File Inclusion.This issue affects WPCafe: from n/a through <= 2.2.32.
- Product
- WPCafe
- Affected
- up to 2.2.32
- What to do
- Affects up to 2.2.32. Update WPCafe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025MaxButtons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39444 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maxfoundry MaxButtons maxbuttons allows Stored XSS.This issue affects MaxButtons: from n/a through <= 9.8.3.
- Product
- MaxButtons
- Affected
- up to 9.8.3
- What to do
- Affects up to 9.8.3. Update MaxButtons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Verge3D: Cross-Site Request Forgery (CSRF)CVE-2025-39443 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Soft8Soft LLC Verge3D verge3d allows Cross Site Request Forgery.This issue affects Verge3D: from n/a through <= 4.9.0.
- Product
- Verge3D
- Affected
- up to 4.9.0
- What to do
- Affects up to 4.9.0. Update Verge3D to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Review Wave – Google Places Reviews: Cross-Site Request Forgery (CSRF)CVE-2025-39442 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in MessageMetric Review Wave – Google Places Reviews review-wave-google-places-reviews allows Stored XSS.This issue affects Review Wave – Google Places Reviews: from n/a through <= 1.4.7.
- Product
- Review Wave – Google Places Reviews
- Affected
- up to 1.4.7
- What to do
- Affects up to 1.4.7. Update Review Wave – Google Places Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Dashboard Notepads: Cross-Site Request Forgery (CSRF)CVE-2025-39441 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in swedish boy Dashboard Notepads dashboard-notepads allows Stored XSS.This issue affects Dashboard Notepads: from n/a through <= 1.2.1.
- Product
- Dashboard Notepads
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Dashboard Notepads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Broken Links Remover: Cross-Site Request Forgery (CSRF)CVE-2025-39440 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Rajesh Broken Links Remover broken-links-remover allows Stored XSS.This issue affects Broken Links Remover: from n/a through <= 1.2.2.
- Product
- Broken Links Remover
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Broken Links Remover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025wpLike2Get: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-39439 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Markus Drubba wpLike2Get wplike2get allows Retrieve Embedded Sensitive Data.This issue affects wpLike2Get: from n/a through <= 1.2.9.
- Product
- wpLike2Get
- Affected
- up to 1.2.9
- What to do
- Affects up to 1.2.9. Update wpLike2Get to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Theme Changer: Cross-Site Request Forgery (CSRF)CVE-2025-39438 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in momen2009 Theme Changer theme-changer allows Cross Site Request Forgery.This issue affects Theme Changer: from n/a through <= 1.4.
- Product
- Theme Changer
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Theme Changer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Anthologize: Cross-Site Request Forgery (CSRF)CVE-2025-39437 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Boone Gorges Anthologize anthologize allows Cross Site Request Forgery.This issue affects Anthologize: from n/a through <= 0.8.3.
- Product
- Anthologize
- Affected
- up to 0.8.3
- What to do
- Affects up to 0.8.3. Update Anthologize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025I Draw: Unrestricted Upload of File with Dangerous TypeCVE-2025-39436 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in aidraw I Draw idraw allows Using Malicious Files.This issue affects I Draw: from n/a through <= 1.0.
- Product
- I Draw
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update I Draw to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025My Marginalia: Cross-Site Request Forgery (CSRF)CVE-2025-39435 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in davidfcarr My Marginalia my-marginalia allows Stored XSS.This issue affects My Marginalia: from n/a through <= 1.0.6.
- Product
- My Marginalia
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update My Marginalia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Avatar: Authorization Bypass Through User-Controlled KeyCVE-2025-39434 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in Scott Taylor Avatar avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Avatar: from n/a through <= 0.1.4.
- Product
- Avatar
- Affected
- up to 0.1.4
- What to do
- Affects up to 0.1.4. Update Avatar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Bknewsticker: Cross-Site Request Forgery (CSRF)CVE-2025-39433 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in beke_ro Bknewsticker bknewsticker allows Stored XSS.This issue affects Bknewsticker: from n/a through <= 1.0.5.
- Product
- Bknewsticker
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Bknewsticker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025bbPress2 shortcode whitelist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39432 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in antonchanning bbPress2 shortcode whitelist bbpress2-shortcode-whitelist allows Stored XSS.This issue affects bbPress2 shortcode whitelist: from n/a through <= 2.2.1.
- Product
- bbPress2 shortcode whitelist
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update bbPress2 shortcode whitelist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Amazon Showcase: Cross-Site Request Forgery (CSRF)CVE-2025-39431 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Aaron Forgue Amazon Showcase WordPress Plugin amazon-showcase-wordpress-widget allows Stored XSS.This issue affects Amazon Showcase WordPress Plugin: from n/a through <= 2.2.
- Product
- Amazon Showcase
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update Amazon Showcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025mLanguage: Cross-Site Request Forgery (CSRF)CVE-2025-39430 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Alexander Rauscha mLanguage mlanguage allows Stored XSS.This issue affects mLanguage: from n/a through <= 1.6.1.
- Product
- mLanguage
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update mLanguage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Széchenyi 2020 Logo: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39429 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Földesi, Mihály Széchenyi 2020 Logo szechenyi-2020-logo allows PHP Local File Inclusion.This issue affects Széchenyi 2020 Logo: from n/a through <= 1.1.
- Product
- Széchenyi 2020 Logo
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Széchenyi 2020 Logo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Gravity Forms CSS Themes with Fontawesome and Placeholders: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39428 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Maros Pristas Gravity Forms CSS Themes with Fontawesome and Placeholders gravity-forms-css-themes-with-fontawesome-and-placeholder-support allows Stored XSS.This issue affects Gravity Forms CSS Themes with Fontawesome and Placeholders: from n/a through <= 8.5.
- Product
- Gravity Forms CSS Themes with Fontawesome and Placeholders
- Affected
- up to 8.5
- What to do
- Affects up to 8.5. Update Gravity Forms CSS Themes with Fontawesome and Placeholders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025WP Post to PDF Enhanced: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39427 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Beth Tucker Long WP Post to PDF Enhanced wp-post-to-pdf-enhanced allows Stored XSS.This issue affects WP Post to PDF Enhanced: from n/a through <= 1.1.1.
- Product
- WP Post to PDF Enhanced
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update WP Post to PDF Enhanced to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025illow – Cookies Consent: Cross-Site Request Forgery (CSRF)CVE-2025-39426 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in illow illow – Cookies Consent lgpd-compliant-cookie-banner allows Cross Site Request Forgery.This issue affects illow – Cookies Consent: from n/a through <= 0.2.0.
- Product
- illow – Cookies Consent
- Affected
- up to 0.2.0
- What to do
- Affects up to 0.2.0. Update illow – Cookies Consent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Style Manager: Cross-Site Request Forgery (CSRF)CVE-2025-39425 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in pixelgrade Style Manager style-manager allows Cross Site Request Forgery.This issue affects Style Manager: from n/a through <= 2.2.7.
- Product
- Style Manager
- Affected
- up to 2.2.7
- What to do
- Affects up to 2.2.7. Update Style Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.