Vulnerability database

41,498 results · page 380 of 830

• Apr 9, 2025Admin Menu Post List: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32492 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eliot Akira Admin Menu Post List admin-menu-post-list allows Stored XSS.This issue affects Admin Menu Post List: from n/a through <= 2.0.7.

  Product

  Admin Menu Post List

  Affected

  up to 2.0.7

  What to do

  Affects up to 2.0.7. Update Admin Menu Post List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Wetterwarner: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32489 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tim Wetterwarner wetterwarner allows Stored XSS.This issue affects Wetterwarner: from n/a through <= 2.7.3.

  Product

  Wetterwarner

  Affected

  up to 2.7.3

  What to do

  Affects up to 2.7.3. Update Wetterwarner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Aria Font: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32488 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in آریا وردپرس Aria Font aria-font allows Stored XSS.This issue affects Aria Font: from n/a through <= 1.4.

  Product

  Aria Font

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Aria Font to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Waymark: Server-Side Request Forgery (SSRF)CVE-2025-32487 · WordPress plugins & themes · reported by PatchstackMedium 4.9

  Server-Side Request Forgery (SSRF) vulnerability in Joe Waymark waymark allows Server Side Request Forgery.This issue affects Waymark: from n/a through <= 1.5.2.

  Product

  Waymark

  Affected

  up to 1.5.2

  What to do

  Affects up to 1.5.2. Update Waymark to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025WP Performance Pack: Cross-Site Request Forgery (CSRF)CVE-2025-32485 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Bjoern WP Performance Pack wp-performance-pack allows Cross Site Request Forgery.This issue affects WP Performance Pack: from n/a through <= 2.5.4.

  Product

  WP Performance Pack

  Affected

  up to 2.5.4

  What to do

  Affects up to 2.5.4. Update WP Performance Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025WP-Planification: Cross-Site Request Forgery (CSRF)CVE-2025-32484 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Mathieu Chartier WP-Planification wp-planification allows Stored XSS.This issue affects WP-Planification: from n/a through <= 2.3.1.

  Product

  WP-Planification

  Affected

  up to 2.3.1

  What to do

  Affects up to 2.3.1. Update WP-Planification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Request Call Back: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32483 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scott Salisbury Request Call Back request-call-back allows Stored XSS.This issue affects Request Call Back: from n/a through <= 1.4.1.

  Product

  Request Call Back

  Affected

  up to 1.4.1

  What to do

  Affects up to 1.4.1. Update Request Call Back to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Custom Smilies: Cross-Site Request Forgery (CSRF)CVE-2025-32482 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in quanganhdo Custom Smilies custom-smilies allows Stored XSS.This issue affects Custom Smilies: from n/a through <= 1.2.

  Product

  Custom Smilies

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Custom Smilies to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Nino Social Connect: Cross-Site Request Forgery (CSRF)CVE-2025-32481 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in ninotheme Nino Social Connect nino-social-connect allows Stored XSS.This issue affects Nino Social Connect: from n/a through <= 2.0.

  Product

  Nino Social Connect

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update Nino Social Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Windows Live Writer: Cross-Site Request Forgery (CSRF)CVE-2025-32480 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in dalziel Windows Live Writer windows-live-writer allows Stored XSS.This issue affects Windows Live Writer: from n/a through <= 0.1.

  Product

  Windows Live Writer

  Affected

  up to 0.1

  What to do

  Affects up to 0.1. Update Windows Live Writer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Flags Widget: Cross-Site Request Forgery (CSRF)CVE-2025-32479 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in ab-tools Flags Widget flags-widget allows Stored XSS.This issue affects Flags Widget: from n/a through <= 1.0.7.

  Product

  Flags Widget

  Affected

  up to 1.0.7

  What to do

  Affects up to 1.0.7. Update Flags Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025WP SexyLightBox: Cross-Site Request Forgery (CSRF)CVE-2025-32478 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Mario Aguiar WP SexyLightBox wp-sexylightbox allows Stored XSS.This issue affects WP SexyLightBox: from n/a through <= 0.5.3.

  Product

  WP SexyLightBox

  Affected

  up to 0.5.3

  What to do

  Affects up to 0.5.3. Update WP SexyLightBox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025WP-Easy Menu: Cross-Site Request Forgery (CSRF)CVE-2025-32477 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Jordi Salord WP-Easy Menu wp-easy-menu allows Stored XSS.This issue affects WP-Easy Menu: from n/a through <= 0.41.

  Product

  WP-Easy Menu

  Affected

  up to 0.41

  What to do

  Affects up to 0.41. Update WP-Easy Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Advanced Tag Lists: Cross-Site Request Forgery (CSRF)CVE-2025-32476 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in blueinstyle Advanced Tag Lists advanced-tag-list allows Stored XSS.This issue affects Advanced Tag Lists: from n/a through <= 1.2.

  Product

  Advanced Tag Lists

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Advanced Tag Lists to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025AF Tell a Friend: Cross-Site Request Forgery (CSRF)CVE-2025-31404 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Wladyslaw Madejczyk AF Tell a Friend af-tell-a-friend allows Stored XSS.This issue affects AF Tell a Friend: from n/a through <= 1.4.

  Product

  AF Tell a Friend

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update AF Tell a Friend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025NewsBoard Post and RSS Scroller: Cross-Site Request Forgery (CSRF)CVE-2025-31402 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in NewsBoard Plugin NewsBoard Post and RSS Scroller newsboard allows Stored XSS.This issue affects NewsBoard Post and RSS Scroller: from n/a through <= 1.2.12.

  Product

  NewsBoard Post and RSS Scroller

  Affected

  up to 1.2.12

  What to do

  Affects up to 1.2.12. Update NewsBoard Post and RSS Scroller to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025MMX – Make Me Christmas: Cross-Site Request Forgery (CSRF)CVE-2025-31401 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in mmetrodw MMX – Make Me Christmas mmx-make-me-christmas allows Stored XSS.This issue affects MMX – Make Me Christmas: from n/a through <= 1.0.0.

  Product

  MMX – Make Me Christmas

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update MMX – Make Me Christmas to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025WS Audio Player: Cross-Site Request Forgery (CSRF)CVE-2025-31400 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in icyleaf WS Audio Player ws-audio-player allows Stored XSS.This issue affects WS Audio Player: from n/a through <= 1.1.8.

  Product

  WS Audio Player

  Affected

  up to 1.1.8

  What to do

  Affects up to 1.1.8. Update WS Audio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025CG Scroll To Top: Cross-Site Request Forgery (CSRF)CVE-2025-31399 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Chandan Garg CG Scroll To Top cg-scroll-to-top allows Stored XSS.This issue affects CG Scroll To Top: from n/a through <= 3.5.

  Product

  CG Scroll To Top

  Affected

  up to 3.5

  What to do

  Affects up to 3.5. Update CG Scroll To Top to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Easy Custom CSS: Cross-Site Request Forgery (CSRF)CVE-2025-31395 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in a.ankit Easy Custom CSS easy-custom-css allows Stored XSS.This issue affects Easy Custom CSS: from n/a through <= 1.0.

  Product

  Easy Custom CSS

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Easy Custom CSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025More Mime Type Filters: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31394 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kailey (trepmal) More Mime Type Filters more-mime-type-filters allows Stored XSS.This issue affects More Mime Type Filters: from n/a through <= 0.3.

  Product

  More Mime Type Filters

  Affected

  up to 0.3

  What to do

  Affects up to 0.3. Update More Mime Type Filters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Social Bookmarking RELOADED: Cross-Site Request Forgery (CSRF)CVE-2025-31393 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in vfvalent Social Bookmarking RELOADED social-bookmarking-reloaded allows Stored XSS.This issue affects Social Bookmarking RELOADED: from n/a through <= 3.18.

  Product

  Social Bookmarking RELOADED

  Affected

  up to 3.18

  What to do

  Affects up to 3.18. Update Social Bookmarking RELOADED to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Smart Product Gallery Slider: Cross-Site Request Forgery (CSRF)CVE-2025-31392 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Shameem Reza Smart Product Gallery Slider smart-product-gallery-slider allows Cross Site Request Forgery.This issue affects Smart Product Gallery Slider: from n/a through <= 1.0.4.

  Product

  Smart Product Gallery Slider

  Affected

  up to 1.0.4

  What to do

  Affects up to 1.0.4. Update Smart Product Gallery Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Script Compressor: Cross-Site Request Forgery (CSRF)CVE-2025-31391 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in regen Script Compressor script-compressor allows Stored XSS.This issue affects Script Compressor: from n/a through <= 1.7.1.

  Product

  Script Compressor

  Affected

  up to 1.7.1

  What to do

  Affects up to 1.7.1. Update Script Compressor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Social Crowd: Cross-Site Request Forgery (CSRF)CVE-2025-31390 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in bdoga Social Crowd social-crowd allows Stored XSS.This issue affects Social Crowd: from n/a through <= 0.9.6.1.

  Product

  Social Crowd

  Affected

  up to 0.9.6.1

  What to do

  Affects up to 0.9.6.1. Update Social Crowd to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025The World: Cross-Site Request Forgery (CSRF)CVE-2025-31388 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in doa The World the-world allows Stored XSS.This issue affects The World: from n/a through <= 0.4.

  Product

  The World

  Affected

  up to 0.4

  What to do

  Affects up to 0.4. Update The World to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Site Table of Contents: Cross-Site Request Forgery (CSRF)CVE-2025-31385 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in intelcaprep Site Table of Contents site-table-of-contents allows Stored XSS.This issue affects Site Table of Contents: from n/a through <= 0.3.

  Product

  Site Table of Contents

  Affected

  up to 0.3

  What to do

  Affects up to 0.3. Update Site Table of Contents to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025FrescoChat Live Chat: Cross-Site Request Forgery (CSRF)CVE-2025-31383 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in sodena FrescoChat Live Chat flexytalk-widget allows Stored XSS.This issue affects FrescoChat Live Chat: from n/a through <= 3.2.6.

  Product

  FrescoChat Live Chat

  Affected

  up to 3.2.6

  What to do

  Affects up to 3.2.6. Update FrescoChat Live Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Language Field: Cross-Site Request Forgery (CSRF)CVE-2025-31382 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in theode Language Field language-field allows Stored XSS.This issue affects Language Field: from n/a through <= 0.9.

  Product

  Language Field

  Affected

  up to 0.9

  What to do

  Affects up to 0.9. Update Language Field to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Woo Product Feed For Marketing Channels: Missing AuthorizationCVE-2025-31377 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Missing Authorization vulnerability in Asaquzzaman mishu Woo Product Feed For Marketing Channels woocommerce-to-google-merchant-center allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Woo Product Feed For Marketing Channels: from n/a through <= 1.9.0.

  Product

  Woo Product Feed For Marketing Channels

  Affected

  up to 1.9.0

  What to do

  Affects up to 1.9.0. Update Woo Product Feed For Marketing Channels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Scheduled: Cross-Site Request Forgery (CSRF)CVE-2025-31375 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in bhoogterp Scheduled scheduled allows Stored XSS.This issue affects Scheduled: from n/a through <= 1.0.

  Product

  Scheduled

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Scheduled to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Sandwich Adsense: Missing AuthorizationCVE-2025-31042 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in rtakao Sandwich Adsense firsth3tagadsense allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sandwich Adsense: from n/a through <= 4.0.2.

  Product

  Sandwich Adsense

  Affected

  up to 4.0.2

  What to do

  Affects up to 4.0.2. Update Sandwich Adsense to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Essential Breadcrumbs: Cross-Site Request Forgery (CSRF)CVE-2025-31038 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Cross-Site Request Forgery (CSRF) vulnerability in Essential Marketer Essential Breadcrumbs essential-breadcrumbs allows Privilege Escalation.This issue affects Essential Breadcrumbs: from n/a through <= 1.1.1.

  Product

  Essential Breadcrumbs

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Essential Breadcrumbs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025WPSolr: Cross-Site Request Forgery (CSRF)CVE-2025-31036 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Cross-Site Request Forgery (CSRF) vulnerability in WPSOLR WPSolr wpsolr-free allows Privilege Escalation.This issue affects WPSolr: from n/a through <= 24.0.

  Product

  WPSolr

  Affected

  up to 24.0

  What to do

  Affects up to 24.0. Update WPSolr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025WP Editor.md – The Perfect WordPress Markdown Editor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31035 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Benjamin Chris WP Editor.md – The Perfect WordPress Markdown Editor wp-editormd allows Stored XSS.This issue affects WP Editor.md – The Perfect WordPress Markdown Editor: from n/a through <= 10.2.1.

  Product

  WP Editor.md – The Perfect WordPress Markdown Editor

  Affected

  up to 10.2.1

  What to do

  Affects up to 10.2.1. Update WP Editor.md – The Perfect WordPress Markdown Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Customize Login Page: Cross-Site Request Forgery (CSRF)CVE-2025-31034 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in AboZain Albanna Customize Login Page customize-login-page allows Cross Site Request Forgery.This issue affects Customize Login Page: from n/a through <= 1.1.

  Product

  Customize Login Page

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Customize Login Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Buddypress Humanity: Cross-Site Request Forgery (CSRF)CVE-2025-31033 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Cross-Site Request Forgery (CSRF) vulnerability in Adam Nowak Buddypress Humanity buddypress-humanity allows Cross Site Request Forgery.This issue affects Buddypress Humanity: from n/a through <= 1.2.

  Product

  Buddypress Humanity

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Buddypress Humanity to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Pagopar – WooCommerce Gateway: Cross-Site Request Forgery (CSRF)CVE-2025-31032 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Pagopar - Grupo M S.A. Pagopar – WooCommerce Gateway pagopar-woocommerce-gateway allows Stored XSS.This issue affects Pagopar – WooCommerce Gateway: from n/a through <= 2.7.1.

  Product

  Pagopar – WooCommerce Gateway

  Affected

  up to 2.7.1

  What to do

  Affects up to 2.7.1. Update Pagopar – WooCommerce Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Comment Validation Reloaded: Cross-Site Request Forgery (CSRF)CVE-2025-31026 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Austin Comment Validation Reloaded comment-validation-reloaded allows Stored XSS.This issue affects Comment Validation Reloaded: from n/a through <= 0.5.

  Product

  Comment Validation Reloaded

  Affected

  up to 0.5

  What to do

  Affects up to 0.5. Update Comment Validation Reloaded to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Seo Meta Tags: Cross-Site Request Forgery (CSRF)CVE-2025-31023 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Cross-Site Request Forgery (CSRF) vulnerability in Purab Seo Meta Tags seo-meta-tags allows Cross Site Request Forgery.This issue affects Seo Meta Tags: from n/a through <= 1.4.

  Product

  Seo Meta Tags

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Seo Meta Tags to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Simple Spoiler: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31020 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webliberty Simple Spoiler simple-spoiler allows Stored XSS.This issue affects Simple Spoiler: from n/a through <= 1.4.

  Product

  Simple Spoiler

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Simple Spoiler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Nav Menu Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31017 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robert Noakes Nav Menu Manager noakes-menu-manager allows Stored XSS.This issue affects Nav Menu Manager: from n/a through <= 3.2.5.

  Product

  Nav Menu Manager

  Affected

  up to 3.2.5

  What to do

  Affects up to 3.2.5. Update Nav Menu Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Age Gate: Missing AuthorizationCVE-2025-31012 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Phil Age Gate age-gate allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Age Gate: from n/a through <= 3.5.4.

  Product

  Age Gate

  Affected

  up to 3.5.4

  What to do

  Affects up to 3.5.4. Update Age Gate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025IndieBlocks: Server-Side Request Forgery (SSRF)CVE-2025-31009 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Server-Side Request Forgery (SSRF) vulnerability in Jan Boddez IndieBlocks indieblocks allows Server Side Request Forgery.This issue affects IndieBlocks: from n/a through <= 0.13.1.

  Product

  IndieBlocks

  Affected

  up to 0.13.1

  What to do

  Affects up to 0.13.1. Update IndieBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025YouTube Embed: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31008 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Embeds For YouTube Plugin Support YouTube Embed youtube-embed allows Stored XSS.This issue affects YouTube Embed: from n/a through <= 5.3.1.

  Product

  YouTube Embed

  Affected

  up to 5.3.1

  What to do

  Affects up to 5.3.1. Update YouTube Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Easyfonts: Cross-Site Request Forgery (CSRF)CVE-2025-31005 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Uzair Easyfonts easyfonts allows Cross Site Request Forgery.This issue affects Easyfonts: from n/a through <= 1.1.2.

  Product

  Easyfonts

  Affected

  up to 1.1.2

  What to do

  Affects up to 1.1.2. Update Easyfonts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Rich Table of Contents: Missing AuthorizationCVE-2025-31004 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Croover.inc Rich Table of Contents rich-table-of-content allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rich Table of Contents: from n/a through <= 1.4.0.

  Product

  Rich Table of Contents

  Affected

  up to 1.4.0

  What to do

  Affects up to 1.4.0. Update Rich Table of Contents to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Squeeze: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-31003 · WordPress plugins & themes · reported by PatchstackLow 2.7

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Bogdan Bendziukov Squeeze squeeze allows Retrieve Embedded Sensitive Data.This issue affects Squeeze: from n/a through <= 1.6.

  Product

  Squeeze

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update Squeeze to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Squeeze: Unrestricted Upload of File with Dangerous TypeCVE-2025-31002 · WordPress plugins & themes · reported by PatchstackCritical 9.1

  Unrestricted Upload of File with Dangerous Type vulnerability in Bogdan Bendziukov Squeeze squeeze allows Using Malicious Files.This issue affects Squeeze: from n/a through <= 1.6.

  Product

  Squeeze

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update Squeeze to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025WordPress/Plugin Upgrade Time Out: Does not have CSRF check in some placesCVE-2024-8243 · WordPress plugins & themes · reported by WPScanMedium 6.3

  The WordPress/Plugin Upgrade Time Out Plugin WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.

  Product

  WordPress/Plugin Upgrade Time Out

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update WordPress/Plugin Upgrade Time Out to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.