Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
41,498 results · page 373 of 830
Apr 17, 2025DeBounce Email Validator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24539 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in debounce DeBounce Email Validator debounce-io-email-validator allows Reflected XSS.This issue affects DeBounce Email Validator: from n/a through <= 5.6.5.
- Product
- DeBounce Email Validator
- Affected
- up to 5.6.5
- What to do
- Affects up to 5.6.5. Update DeBounce Email Validator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Editor Wysiwyg Background Color: Missing AuthorizationCVE-2025-23958 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in FADI MED Editor Wysiwyg Background Color editor-wysiwyg-background-color allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Editor Wysiwyg Background Color: from n/a through <= 1.0.
- Product
- Editor Wysiwyg Background Color
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Editor Wysiwyg Background Color to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025WordPress Dashboard Tweeter: Missing AuthorizationCVE-2025-23906 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in wpseek WordPress Dashboard Tweeter allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WordPress Dashboard Tweeter: from n/a through 1.3.2.
- Product
- WordPress Dashboard Tweeter
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update WordPress Dashboard Tweeter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Custom Users Order: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23858 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hiren Patel Custom Users Order custom-users-order allows Reflected XSS.This issue affects Custom Users Order: from n/a through <= 4.2.
- Product
- Custom Users Order
- Affected
- up to 4.2
- What to do
- Affects up to 4.2. Update Custom Users Order to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025SpiderDisplay: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23855 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fyljp SpiderDisplay spiderdisplay allows Reflected XSS.This issue affects SpiderDisplay: from n/a through <= 1.9.1.
- Product
- SpiderDisplay
- Affected
- up to 1.9.1
- What to do
- Affects up to 1.9.1. Update SpiderDisplay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025TotalContest Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23782 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TotalSuite TotalContest Lite totalcontest-lite allows Reflected XSS.This issue affects TotalContest Lite: from n/a through <= 2.8.1.
- Product
- TotalContest Lite
- Affected
- up to 2.8.1
- What to do
- Affects up to 2.8.1. Update TotalContest Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025mingocommerce Delete All Posts: Missing AuthorizationCVE-2025-23773 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in mingocommerce Delete All Posts allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Delete All Posts: through 1.1.1.
- Product
- mingocommerce Delete All Posts
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update mingocommerce Delete All Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025visualslider Sldier: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23448 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dastan800 visualslider Sldier visual-slider allows Reflected XSS.This issue affects visualslider Sldier: from n/a through <= 1.1.1.
- Product
- visualslider Sldier
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update visualslider Sldier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Author Showcase: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23443 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Claire Ryan Author Showcase author-showcase allows Reflected XSS.This issue affects Author Showcase: from n/a through <= 1.4.3.
- Product
- Author Showcase
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update Author Showcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025WP-Asambleas: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22796 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in platcom WP-Asambleas wp-asambleas allows Reflected XSS.This issue affects WP-Asambleas: from n/a through <= 2.85.0.
- Product
- WP-Asambleas
- Affected
- up to 2.85.0
- What to do
- Affects up to 2.85.0. Update WP-Asambleas to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025CRUDLab Scroll to Top: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22774 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRUDLab CRUDLab Scroll to Top crudlab-scroll-to-top allows Reflected XSS.This issue affects CRUDLab Scroll to Top: from n/a through <= 1.0.1.
- Product
- CRUDLab Scroll to Top
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update CRUDLab Scroll to Top to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025The Great Firewords of China: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22771 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Studio Hyperset The Great Firewords of China sensitive-chinese-words-scanner allows Stored XSS.This issue affects The Great Firewords of China: from n/a through <= 1.2.
- Product
- The Great Firewords of China
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update The Great Firewords of China to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Sponsered Link: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22692 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rachanaS Sponsered Link sponsered-link allows Reflected XSS.This issue affects Sponsered Link: from n/a through <= 4.0.
- Product
- Sponsered Link
- Affected
- up to 4.0
- What to do
- Affects up to 4.0. Update Sponsered Link to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025CWD – Stealth Links: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22655 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Caio Web Dev CWD – Stealth Links cwd-stealth-links allows SQL Injection.This issue affects CWD – Stealth Links: from n/a through <= 1.3.
- Product
- CWD – Stealth Links
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update CWD – Stealth Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Stylish Google Sheet Reader: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22651 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wppluginboxdev Stylish Google Sheet Reader stylish-google-sheet-reader allows Reflected XSS.This issue affects Stylish Google Sheet Reader: from n/a through <= 4.0.
- Product
- Stylish Google Sheet Reader
- Affected
- up to 4.0
- What to do
- Affects up to 4.0. Update Stylish Google Sheet Reader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025VR-Frases: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22636 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vicente Ruiz Gálvez VR-Frases vr-frases allows Reflected XSS.This issue affects VR-Frases: from n/a through <= 4.0.1.
- Product
- VR-Frases
- Affected
- up to 4.0.1
- What to do
- Affects up to 4.0.1. Update VR-Frases to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025vooPlayer v4: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22565 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bill Zimmerman vooPlayer v4 vooplayer allows Reflected XSS.This issue affects vooPlayer v4: from n/a through <= 4.0.4.
- Product
- vooPlayer v4
- Affected
- up to 4.0.4
- What to do
- Affects up to 4.0.4. Update vooPlayer v4 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Data Dash: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22340 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 Data Dash data-dash allows Stored XSS.This issue affects Data Dash: from n/a through <= 1.2.3.
- Product
- Data Dash
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Data Dash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Stored Cross-Site ScriptingCVE-2025-3487 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘limit’ parameter in all versions up to, and including, 1.42.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder
- Affected
- up to 1.42.0
- What to do
- Affects up to 1.42.0. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 17, 2025Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Order ReplayCVE-2025-3479 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Order Replay in all versions up to, and including, 1.42.0 via the 'handle_stripe_single' function due to insufficient validation on a user controlled key. This makes it possible for unauthenticated attackers to reuse a single Stripe PaymentIntent for multiple transactions. Only the first transaction is processed via Stripe, but the plugin sends a successful email message for each transaction, which may trick an administrator into fulfilling each order.
- Product
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder
- Affected
- up to 1.42.0
- What to do
- Affects up to 1.42.0. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 17, 2025The Password Protected – Password Protect your WordPress Site, Pages, & WooCommerce Products – Restrict Content, Protect WooCommerce Category and more plugin foCVE-2025-3453 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Password Protected – Password Protect your WordPress Site, Pages, & WooCommerce Products – Restrict Content, Protect WooCommerce Category and more plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.7 via the 'password_protected_cookie' function. This makes it possible for unauthenticated attackers to extract sensitive data including all protected site content if the 'Use Transient' setting is enabled.
- Affected
- up to 2.7.7
- What to do
- Affects up to 2.7.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 17, 2025Fluent Forms: Stored Cross-Site ScriptingCVE-2025-3615 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Fluent Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form-submission.js script in all versions up to, and including, 6.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Fluent Forms
- Affected
- up to 6.0.2
- What to do
- Affects up to 6.0.2. Update Fluent Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 17, 2025WP Editor: Arbitrary file readCVE-2025-3295 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The WP Editor plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.2.9.1. This makes it possible for authenticated attackers, with Administrator-level access and above, to read arbitrary files on the affected site's server which may reveal sensitive information.
- Product
- WP Editor
- Affected
- up to 1.2.9.1
- What to do
- Affects up to 1.2.9.1. Update WP Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 17, 2025WP Editor: Arbitrary file updateCVE-2025-3294 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Editor plugin for WordPress is vulnerable to arbitrary file update due to missing file path validation in all versions up to, and including, 1.2.9.1. This makes it possible for authenticated attackers, with Administrator-level access and above, to overwrite arbitrary files on the affected site's server which may make remote code execution possible assuming the files can be written to by the web server.
- Product
- WP Editor
- Affected
- up to 1.2.9.1
- What to do
- Affects up to 1.2.9.1. Update WP Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 17, 2025Ultimate Dashboard: Does not sanitise and escape some of its settingsCVE-2025-1525 · WordPress plugins & themes · reported by WPScanLow 3.5
The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Ultimate Dashboard
- Fixed in
- 3.8.6
- What to do
- Update Ultimate Dashboard to 3.8.6 or newer.
Apr 17, 2025Ultimate Dashboard: Does not sanitise and escape some of its settingsCVE-2025-1524 · WordPress plugins & themes · reported by WPScanLow 3.5
The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Ultimate Dashboard
- Fixed in
- 3.8.6
- What to do
- Update Ultimate Dashboard to 3.8.6 or newer.
Apr 17, 2025Ultimate Dashboard: Does not sanitise and escape some of its settingsCVE-2025-1523 · WordPress plugins & themes · reported by WPScanLow 3.5
The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Ultimate Dashboard
- Fixed in
- 3.8.6
- What to do
- Update Ultimate Dashboard to 3.8.6 or newer.
Apr 17, 2025Klarna Checkout for WooCommerce: Exposes an unauthenticated WooCommerce Ajax endpoint that allows an attacker to flood the log files with data at the maximum size allowed for a POST parameter per requestCVE-2024-13925 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Klarna Checkout for WooCommerce WordPress plugin before 2.13.5 exposes an unauthenticated WooCommerce Ajax endpoint that allows an attacker to flood the log files with data at the maximum size allowed for a POST parameter per request. This can result in rapid consumption of disk space, potentially filling the entire disk.
- Product
- Klarna Checkout for WooCommerce
- Fixed in
- 2.13.5
- What to do
- Update Klarna Checkout for WooCommerce to 2.13.5 or newer.
Apr 17, 2025Icegram Express formerly known as Email Subscribers: Does not sanitise and escape some of its settingsCVE-2024-11924 · WordPress plugins & themes · reported by WPScanLow 3.5
The Icegram Express formerly known as Email Subscribers WordPress plugin before 5.7.52 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Icegram Express formerly known as Email Subscribers
- Fixed in
- 5.7.52
- What to do
- Update Icegram Express formerly known as Email Subscribers to 5.7.52 or newer.
Apr 16, 2025WooCommerce Social Login: Cross-Site Request Forgery (CSRF)CVE-2025-39472 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in wpweb WooCommerce Social Login woo-social-login allows Cross Site Request Forgery.This issue affects WooCommerce Social Login: from n/a through < 2.8.3.
- Product
- WooCommerce Social Login
- Fixed in
- 2.8.3
- What to do
- Update WooCommerce Social Login to 2.8.3 or newer.
Apr 16, 2025WooCommerce Product Table Lite: Missing AuthorizationCVE-2025-39602 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WC Product Table WooCommerce Product Table Lite wc-product-table-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Product Table Lite: from n/a through <= 3.9.5.
- Product
- WooCommerce Product Table Lite
- Affected
- up to 3.9.5
- What to do
- Affects up to 3.9.5. Update WooCommerce Product Table Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 16, 2025Custom CSS, JS & PHP: Cross-Site Request Forgery (CSRF)CVE-2025-39601 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in WPFactory Custom CSS, JS & PHP custom-css allows Remote Code Inclusion.This issue affects Custom CSS, JS & PHP: from n/a through <= 2.4.1.
- Product
- Custom CSS, JS & PHP
- Affected
- up to 2.4.1
- What to do
- Affects up to 2.4.1. Update Custom CSS, JS & PHP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 16, 2025Integration for WooCommerce and QuickBooks: Cross-Site Request Forgery (CSRF)CVE-2025-39600 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks Integration for WooCommerce and QuickBooks wp-woocommerce-quickbooks allows Cross Site Request Forgery.This issue affects Integration for WooCommerce and QuickBooks: from n/a through <= 1.3.1.
- Product
- Integration for WooCommerce and QuickBooks
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Integration for WooCommerce and QuickBooks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 16, 2025Listdom: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-39599 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Webilia Inc. Listdom listdom allows Phishing.This issue affects Listdom: from n/a through <= 4.0.0.
- Product
- Listdom
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update Listdom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 16, 2025Administrator Z: Path Traversal: '.../...//'CVE-2025-39598 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Path Traversal: '.../...//' vulnerability in Quý Lê 91 Administrator Z administrator-z allows Path Traversal.This issue affects Administrator Z: from n/a through <= 2025.03.28.
- Product
- Administrator Z
- Affected
- up to 2025.03.28
- What to do
- Affects up to 2025.03.28. Update Administrator Z to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 16, 2025Fast eBay Listings: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-39597 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Arthur Yarwood Fast eBay Listings fast-ebay-listings allows Phishing.This issue affects Fast eBay Listings: from n/a through <= 2.12.15.
- Product
- Fast eBay Listings
- Affected
- up to 2.12.15
- What to do
- Affects up to 2.12.15. Update Fast eBay Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 16, 2025Ever Accounting: Cross-Site Request Forgery (CSRF)CVE-2025-39593 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in EverAccounting Ever Accounting wp-ever-accounting allows Cross Site Request Forgery.This issue affects Ever Accounting: from n/a through <= 2.1.5.
- Product
- Ever Accounting
- Affected
- up to 2.1.5
- What to do
- Affects up to 2.1.5. Update Ever Accounting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 16, 2025Subscribe to Unlock Lite: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39592 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Shuffle Subscribe to Unlock Lite subscribe-to-unlock-lite allows PHP Local File Inclusion.This issue affects Subscribe to Unlock Lite: from n/a through <= 1.3.0.
- Product
- Subscribe to Unlock Lite
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Subscribe to Unlock Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 16, 2025WP Subscription Forms: Missing AuthorizationCVE-2025-39591 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WP Shuffle WP Subscription Forms wp-subscription-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Subscription Forms: from n/a through <= 1.2.3.
- Product
- WP Subscription Forms
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update WP Subscription Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 16, 2025Essential Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39590 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Stored XSS.This issue affects Essential Addons for Elementor: from n/a through <= 6.1.9.
- Product
- Essential Addons for Elementor
- Affected
- up to 6.1.9
- What to do
- Affects up to 6.1.9. Update Essential Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 16, 2025Essential Addons for Elementor: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-39589 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Retrieve Embedded Sensitive Data.This issue affects Essential Addons for Elementor: from n/a through <= 6.1.9.
- Product
- Essential Addons for Elementor
- Affected
- up to 6.1.9
- What to do
- Affects up to 6.1.9. Update Essential Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 16, 2025Travelfic Toolkit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39585 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Travelfic Toolkit travelfic-toolkit allows Stored XSS.This issue affects Travelfic Toolkit: from n/a through <= 1.2.1.
- Product
- Travelfic Toolkit
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Travelfic Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 16, 2025Eventin: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39584 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Arraytics Eventin wp-event-solution allows PHP Local File Inclusion.This issue affects Eventin: from n/a through <= 4.0.25.
- Product
- Eventin
- Affected
- up to 4.0.25
- What to do
- Affects up to 4.0.25. Update Eventin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 16, 2025WP Data Access: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39582 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Passionate Programmer Peter WP Data Access wp-data-access allows DOM-Based XSS.This issue affects WP Data Access: from n/a through <= 5.5.36.
- Product
- WP Data Access
- Affected
- up to 5.5.36
- What to do
- Affects up to 5.5.36. Update WP Data Access to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 16, 2025Themify Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39581 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Shortcodes themify-shortcodes allows Stored XSS.This issue affects Themify Shortcodes: from n/a through <= 2.1.3.
- Product
- Themify Shortcodes
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update Themify Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 16, 2025Membership For WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39579 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Swings Membership For WooCommerce membership-for-woocommerce allows DOM-Based XSS.This issue affects Membership For WooCommerce: from n/a through <= 2.8.0.
- Product
- Membership For WooCommerce
- Affected
- up to 2.8.0
- What to do
- Affects up to 2.8.0. Update Membership For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 16, 2025Responsive Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39578 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyberChimps Responsive Blocks responsive-block-editor-addons allows Stored XSS.This issue affects Responsive Blocks: from n/a through <= 2.0.2.
- Product
- Responsive Blocks
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update Responsive Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 16, 2025PropertyHive: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39577 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Property Hive PropertyHive propertyhive allows Stored XSS.This issue affects PropertyHive: from n/a through <= 2.1.2.
- Product
- PropertyHive
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update PropertyHive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 16, 2025WPAdverts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39576 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts wpadverts allows Stored XSS.This issue affects WPAdverts: from n/a through <= 2.2.1.
- Product
- WPAdverts
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update WPAdverts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 16, 2025WPCasa: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39575 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPSight WPCasa wpcasa allows Stored XSS.This issue affects WPCasa: from n/a through <= 1.3.2.
- Product
- WPCasa
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update WPCasa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.