Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,221 results · page 37 of 85
Feb 7, 2025Indeed API: Cross-Site Request Forgery (CSRF)CVE-2025-25103 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in bnielsen Indeed API indeed-api allows Cross Site Request Forgery.This issue affects Indeed API: from n/a through <= 0.5.
- Product
- Indeed API
- Affected
- up to 0.5
- What to do
- Affects up to 0.5. Update Indeed API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025Munk Sites: Cross-Site Request Forgery (CSRF)CVE-2025-25101 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in MetricThemes Munk Sites munk-sites allows Cross Site Request Forgery.This issue affects Munk Sites: from n/a through <= 1.0.7.
- Product
- Munk Sites
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update Munk Sites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025Child Themes Helper: Cross-Site Request Forgery (CSRF)CVE-2025-25093 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Cross-Site Request Forgery (CSRF) vulnerability in paulswarthout Child Themes Helper child-themes-helper allows Path Traversal.This issue affects Child Themes Helper: from n/a through <= 2.2.7.
- Product
- Child Themes Helper
- Affected
- up to 2.2.7
- What to do
- Affects up to 2.2.7. Update Child Themes Helper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025WP Keyword Monitor: Cross-Site Request Forgery (CSRF)CVE-2025-25088 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in blackus3r WP Keyword Monitor wp-keyword-monitor allows Cross Site Request Forgery.This issue affects WP Keyword Monitor: from n/a through <= 1.0.5.
- Product
- WP Keyword Monitor
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update WP Keyword Monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025Show notice or message on admin area: Cross-Site Request Forgery (CSRF)CVE-2025-25075 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Venugopal Show notice or message on admin area show-notice-or-message-on-admin-area allows Stored XSS.This issue affects Show notice or message on admin area: from n/a through <= 2.0.
- Product
- Show notice or message on admin area
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Show notice or message on admin area to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025WP Social Stream: Cross-Site Request Forgery (CSRF)CVE-2025-25074 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Nirmal Kumar Ram WP Social Stream wp-social-stream allows Stored XSS.This issue affects WP Social Stream: from n/a through <= 1.1.
- Product
- WP Social Stream
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update WP Social Stream to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025WP Admin Custom Page: Cross-Site Request Forgery (CSRF)CVE-2025-25072 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in thunderbax WP Admin Custom Page wp-admin-custom-page allows Stored XSS.This issue affects WP Admin Custom Page: from n/a through <= 1.5.0.
- Product
- WP Admin Custom Page
- Affected
- up to 1.5.0
- What to do
- Affects up to 1.5.0. Update WP Admin Custom Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025Vignette Ads: Cross-Site Request Forgery (CSRF)CVE-2025-25071 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in topplugins Vignette Ads vignete-ads allows Stored XSS.This issue affects Vignette Ads: from n/a through <= 0.2.
- Product
- Vignette Ads
- Affected
- up to 0.2
- What to do
- Affects up to 0.2. Update Vignette Ads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 4, 2025ShopSite: Cross-Site Request ForgeryCVE-2024-13510 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The ShopSite plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.10. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- ShopSite
- Affected
- up to 1.5.10
- What to do
- Affects up to 1.5.10. Update ShopSite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 4, 2025DSGVO All in one for WP: Cross-Site Request ForgeryCVE-2024-13356 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The DSGVO All in one for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6. This is due to missing or incorrect nonce validation in the user_remove_form.php file. This makes it possible for unauthenticated attackers to delete admin user accounts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- DSGVO All in one for WP
- Affected
- up to 4.6
- What to do
- Affects up to 4.6. Update DSGVO All in one for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 4, 2025Cross-site request forgery vulnerability exists in Activity Log WinterLock versions prior to 1.2.5.CVE-2025-24982 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 4.3
Cross-site request forgery vulnerability exists in Activity Log WinterLock versions prior to 1.2.5. If a user views a malicious page while logged in, the log data may be deleted.
- What to do
- Update the plugin to the newest version.
Feb 3, 2025Forge – Front-End Page Builder: Cross-Site Request Forgery (CSRF)CVE-2025-22703 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in manuelvicedo Forge – Front-End Page Builder forge allows Stored XSS.This issue affects Forge – Front-End Page Builder: from n/a through <= 1.4.6.
- Product
- Forge – Front-End Page Builder
- Affected
- up to 1.4.6
- What to do
- Affects up to 1.4.6. Update Forge – Front-End Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 3, 2025Traveler Layout Essential For Elementor: Server-Side Request Forgery (SSRF)CVE-2025-22701 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Server-Side Request Forgery (SSRF) vulnerability in shinetheme Traveler Layout Essential For Elementor traveler-layout-essential-for-elementor.This issue affects Traveler Layout Essential For Elementor: from n/a through < 1.4.
- Product
- Traveler Layout Essential For Elementor
- What to do
- Update Traveler Layout Essential For Elementor to the newest version.
Feb 3, 2025DigiTimber cPanel Integration: Cross-Site Request Forgery (CSRF)CVE-2025-22690 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in DigiTimber DigiTimber cPanel Integration digitimber-cpanel-integration allows Stored XSS.This issue affects DigiTimber cPanel Integration: from n/a through <= 1.4.6.
- Product
- DigiTimber cPanel Integration
- Affected
- up to 1.4.6
- What to do
- Affects up to 1.4.6. Update DigiTimber cPanel Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 3, 2025Unlimited Page Sidebars: Cross-Site Request Forgery (CSRF)CVE-2025-22688 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Ederson Peka Unlimited Page Sidebars unlimited-page-sidebars allows Stored XSS.This issue affects Unlimited Page Sidebars: from n/a through <= 0.2.6.
- Product
- Unlimited Page Sidebars
- Affected
- up to 0.2.6
- What to do
- Affects up to 0.2.6. Update Unlimited Page Sidebars to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 3, 2025Tags to Keywords: Cross-Site Request Forgery (CSRF)CVE-2025-22685 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in CheGevara29 Tags to Keywords tags-to-meta-keywords allows Stored XSS.This issue affects Tags to Keywords: from n/a through <= 1.0.1.
- Product
- Tags to Keywords
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Tags to Keywords to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025EZPZ SAML SP Single Sign On (SSO): Cross-Site Request Forgery (CSRF)CVE-2025-24749 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Overt Software Solutions LTD EZPZ SAML SP Single Sign On (SSO) allows Cross Site Request Forgery. This issue affects EZPZ SAML SP Single Sign On (SSO): from n/a through 1.2.5.
- Product
- EZPZ SAML SP Single Sign On (SSO)
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update EZPZ SAML SP Single Sign On (SSO) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025Post Meta: Cross-Site Request Forgery (CSRF)CVE-2025-24549 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Mahbubur Rahman Post Meta post-meta allows Reflected XSS.This issue affects Post Meta: from n/a through <= 1.0.9.
- Product
- Post Meta
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Post Meta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025Scroll Styler: Cross-Site Request Forgery (CSRF)CVE-2025-23990 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in jablonczay Scroll Styler scroll-styler.This issue affects Scroll Styler: from n/a through <= 1.1.
- Product
- Scroll Styler
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Scroll Styler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025Internal Link Builder: Cross-Site Request Forgery (CSRF)CVE-2025-23989 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Alessandro Piconi Internal Link Builder internal-link-builder allows Cross Site Request Forgery.This issue affects Internal Link Builder: from n/a through <= 1.0.
- Product
- Internal Link Builder
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Internal Link Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025Dynamic URL SEO: Cross-Site Request Forgery (CSRF)CVE-2025-23985 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in brainvireinfo Dynamic URL SEO dynamic-url-seo allows Cross Site Request Forgery.This issue affects Dynamic URL SEO: from n/a through <= 1.0.
- Product
- Dynamic URL SEO
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Dynamic URL SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025Full Circle: Cross-Site Request Forgery (CSRF)CVE-2025-23980 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in James Andrews Full Circle full-circle allows Stored XSS.This issue affects Full Circle: from n/a through <= 0.5.7.8.
- Product
- Full Circle
- Affected
- up to 0.5.7.8
- What to do
- Affects up to 0.5.7.8. Update Full Circle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025FlashCounter: Cross-Site Request Forgery (CSRF)CVE-2025-23978 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Ninos FlashCounter flashcounter allows Stored XSS.This issue affects FlashCounter: from n/a through <= 1.1.8.
- Product
- FlashCounter
- Affected
- up to 1.1.8
- What to do
- Affects up to 1.1.8. Update FlashCounter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025Post Carousel Slider: Cross-Site Request Forgery (CSRF)CVE-2025-23977 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Bhaskar Dhote Post Carousel Slider post-carousel-slider allows Stored XSS.This issue affects Post Carousel Slider: from n/a through <= 2.0.1.
- Product
- Post Carousel Slider
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update Post Carousel Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025Issuu Panel: Cross-Site Request Forgery (CSRF)CVE-2025-23976 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in operationsissuu Issuu Panel issuu-panel allows Stored XSS.This issue affects Issuu Panel: from n/a through <= 2.1.1.
- Product
- Issuu Panel
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Issuu Panel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025Oshine Modules: Server-Side Request Forgery (SSRF)CVE-2024-44055 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Server-Side Request Forgery (SSRF) vulnerability in brandexponents Oshine Modules oshine-modules.This issue affects Oshine Modules: from n/a through < 3.3.8.
- Product
- Oshine Modules
- What to do
- Update Oshine Modules to the newest version.
Jan 30, 2025WP Image Uploader: Cross-Site Request ForgeryCVE-2024-13707 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Image Uploader plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the gky_image_uploader_main_function() function. This makes it possible for unauthenticated attackers to delete arbitrary files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- WP Image Uploader
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update WP Image Uploader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 30, 2025Wonder FontAwesome: Cross-Site Request ForgeryCVE-2024-13512 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Wonder FontAwesome plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.8. This is due to missing or incorrect nonce validation on one of its functions. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Wonder FontAwesome
- Affected
- up to 0.8
- What to do
- Affects up to 0.8. Update Wonder FontAwesome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Jan 30, 2025CP Contact Form with PayPal: Cross-Site Request ForgeryCVE-2024-13758 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The CP Contact Form with PayPal plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.52. This is due to missing or incorrect nonce validation on the cp_contact_form_paypal_check_init_actions() function. This makes it possible for unauthenticated attackers to add discount codes via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- CP Contact Form with PayPal
- Affected
- up to 1.3.52
- What to do
- Affects up to 1.3.52. Update CP Contact Form with PayPal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 28, 2025MailUp Auto Subscription: Cross-Site Request ForgeryCVE-2024-13521 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The MailUp Auto Subscription plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing or incorrect nonce validation on the mas_options function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- MailUp Auto Subscription
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update MailUp Auto Subscription to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 27, 2025WP Go Maps: Cross-Site Request Forgery (CSRF)CVE-2025-24742 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WPGMaps WP Go Maps wp-google-maps.This issue affects WP Go Maps: from n/a through <= 9.0.40.
- Product
- WP Go Maps
- Affected
- up to 9.0.40
- What to do
- Affects up to 9.0.40. Update WP Go Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: Cross-Site Request Forgery (CSRF)CVE-2025-24540 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd coming-soon allows Cross Site Request Forgery.This issue affects Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: from n/a through <= 6.18.9.
- Product
- Coming Soon Page, Under Construction & Maintenance Mode by SeedProd
- Affected
- up to 6.18.9
- What to do
- Affects up to 6.18.9. Update Coming Soon Page, Under Construction & Maintenance Mode by SeedProd to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025BuddyPress Groups Extras: Cross-Site Request Forgery (CSRF)CVE-2025-24538 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Slava Abakumov BuddyPress Groups Extras buddypress-groups-extras allows Cross Site Request Forgery.This issue affects BuddyPress Groups Extras: from n/a through <= 3.6.10.
- Product
- BuddyPress Groups Extras
- Affected
- up to 3.6.10
- What to do
- Affects up to 3.6.10. Update BuddyPress Groups Extras to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025The Events Calendar: Cross-Site Request Forgery (CSRF)CVE-2025-24537 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in StellarWP The Events Calendar the-events-calendar allows Cross Site Request Forgery.This issue affects The Events Calendar: from n/a through <= 6.7.0.
- Product
- The Events Calendar
- Affected
- up to 6.7.0
- What to do
- Affects up to 6.7.0. Update The Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025Responsive Slider by MetaSlider: Cross-Site Request Forgery (CSRF)CVE-2025-24533 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in MetaSlider Responsive Slider by MetaSlider ml-slider allows Cross Site Request Forgery.This issue affects Responsive Slider by MetaSlider: from n/a through <= 3.92.0.
- Product
- Responsive Slider by MetaSlider
- Affected
- up to 3.92.0
- What to do
- Affects up to 3.92.0. Update Responsive Slider by MetaSlider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 26, 2025VikBooking Hotel Booking Engine & PMS: Cross-Site Request ForgeryCVE-2024-11641 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.2. This is due to missing or incorrect nonce validation on the 'save' function. This makes it possible for unauthenticated attackers to change plugin access privileges via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Successful exploitation allows attackers with subscriber-level privileges and above to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- VikBooking Hotel Booking Engine & PMS
- Affected
- up to 1.7.2
- What to do
- Affects up to 1.7.2. Update VikBooking Hotel Booking Engine & PMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 26, 2025Multiple Page Generator Plugin – MPG: Server-Side Request ForgeryCVE-2024-10705 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.0.5 via the 'mpg_download_file_by_link' function. This makes it possible for authenticated attackers, with editor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- Product
- Multiple Page Generator Plugin – MPG
- Affected
- up to 4.0.5
- What to do
- Affects up to 4.0.5. Update Multiple Page Generator Plugin – MPG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 25, 2025Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder: Server-Side Request ForgeryCVE-2024-13450 · WordPress plugins & themes · reported by WordfenceLow 3.8
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.17.4 via the Webhooks integration. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. The vulnerability can also be exploited in Multisite environments.
- Product
- Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder
- Affected
- up to 2.17.4
- What to do
- Affects up to 2.17.4. Update Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 25, 2025Target Video Easy Publish: Cross-Site Request ForgeryCVE-2024-12076 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Target Video Easy Publish plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.3. This is due to missing or incorrect nonce validation on the resync_carousel(), seek_snapshot(), uploaded_cc(), and remove_cc() functions. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Target Video Easy Publish
- Affected
- up to 3.8.3
- What to do
- Affects up to 3.8.3. Update Target Video Easy Publish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 24, 2025Linear: Cross-Site Request ForgeryCVE-2024-13709 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Linear plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.1. This is due to missing or incorrect nonce validation on the 'linear-debug'. This makes it possible for unauthenticated attackers to reset the plugin's cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Linear
- Affected
- up to 2.8.1
- What to do
- Affects up to 2.8.1. Update Linear to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 24, 2025Roi Calculator: Cross-Site Request Forgery (CSRF)CVE-2025-24756 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in mgplugin Roi Calculator roi-calculator allows Stored XSS.This issue affects Roi Calculator: from n/a through <= 1.0.
- Product
- Roi Calculator
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Roi Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025FluentSMTP: Cross-Site Request Forgery (CSRF)CVE-2025-24739 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Shahjahan Jewel FluentSMTP fluent-smtp allows Cross Site Request Forgery.This issue affects FluentSMTP: from n/a through <= 2.2.80.
- Product
- FluentSMTP
- Affected
- up to 2.2.80
- What to do
- Affects up to 2.2.80. Update FluentSMTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Call Now Button: Cross-Site Request Forgery (CSRF)CVE-2025-24738 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Jerry Rietveld Call Now Button call-now-button allows Cross Site Request Forgery.This issue affects Call Now Button: from n/a through <= 1.4.13.
- Product
- Call Now Button
- Affected
- up to 1.4.13
- What to do
- Affects up to 1.4.13. Update Call Now Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Side Menu Lite: Cross-Site Request Forgery (CSRF)CVE-2025-24724 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Side Menu Lite side-menu-lite allows Cross Site Request Forgery.This issue affects Side Menu Lite: from n/a through <= 5.3.1.
- Product
- Side Menu Lite
- Affected
- up to 5.3.1
- What to do
- Affects up to 5.3.1. Update Side Menu Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Sticky Buttons: Cross-Site Request Forgery (CSRF)CVE-2025-24720 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Sticky Buttons sticky-buttons allows Cross Site Request Forgery.This issue affects Sticky Buttons: from n/a through <= 4.1.1.
- Product
- Sticky Buttons
- Affected
- up to 4.1.1
- What to do
- Affects up to 4.1.1. Update Sticky Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Modal Window: Cross-Site Request Forgery (CSRF)CVE-2025-24717 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Modal Window modal-window allows Cross Site Request Forgery.This issue affects Modal Window: from n/a through <= 6.1.4.
- Product
- Modal Window
- Affected
- up to 6.1.4
- What to do
- Affects up to 6.1.4. Update Modal Window to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Herd Effects: Cross-Site Request Forgery (CSRF)CVE-2025-24716 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Herd Effects mwp-herd-effect allows Cross Site Request Forgery.This issue affects Herd Effects: from n/a through <= 6.2.1.
- Product
- Herd Effects
- Affected
- up to 6.2.1
- What to do
- Affects up to 6.2.1. Update Herd Effects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Counter Box: Cross-Site Request Forgery (CSRF)CVE-2025-24715 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Counter Box counter-box allows Cross Site Request Forgery.This issue affects Counter Box: from n/a through <= 2.0.5.
- Product
- Counter Box
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update Counter Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Bubble Menu – circle floating menu: Cross-Site Request Forgery (CSRF)CVE-2025-24714 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Bubble Menu – circle floating menu bubble-menu allows Cross Site Request Forgery.This issue affects Bubble Menu – circle floating menu: from n/a through <= 4.0.2.
- Product
- Bubble Menu – circle floating menu
- Affected
- up to 4.0.2
- What to do
- Affects up to 4.0.2. Update Bubble Menu – circle floating menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Button Generator – easily Button Builder: Cross-Site Request Forgery (CSRF)CVE-2025-24713 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Button Generator – easily Button Builder button-generation allows Cross Site Request Forgery.This issue affects Button Generator – easily Button Builder: from n/a through <= 3.1.1.
- Product
- Button Generator – easily Button Builder
- Affected
- up to 3.1.1
- What to do
- Affects up to 3.1.1. Update Button Generator – easily Button Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.