Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
41,587 results · page 418 of 832
Feb 25, 2025Icon List Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26937 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Icon List Block icon-list-block allows Stored XSS.This issue affects Icon List Block: from n/a through <= 1.1.3.
- Product
- Icon List Block
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Icon List Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025WP Job Portal: Path Traversal: '.../...//'CVE-2025-26935 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Path Traversal: '.../...//' vulnerability in wpjobportal WP Job Portal wp-job-portal allows PHP Local File Inclusion.This issue affects WP Job Portal: from n/a through <= 2.2.8.
- Product
- WP Job Portal
- Affected
- up to 2.2.8
- What to do
- Affects up to 2.2.8. Update WP Job Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025ChatBot: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-26932 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in QuantumCloud ChatBot chatbot allows PHP Local File Inclusion.This issue affects ChatBot: from n/a through <= 6.3.5.
- Product
- ChatBot
- Affected
- up to 6.3.5
- What to do
- Affects up to 6.3.5. Update ChatBot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Tribulant Gallery Voting: Cross-Site Request Forgery (CSRF)CVE-2025-26931 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software Tribulant Gallery Voting gallery-voting allows Stored XSS.This issue affects Tribulant Gallery Voting: from n/a through <= 1.2.1.
- Product
- Tribulant Gallery Voting
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Tribulant Gallery Voting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Order Limit for WooCommerce: Missing AuthorizationCVE-2025-26928 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Xfinitysoft Order Limit for WooCommerce wc-order-limit-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Limit for WooCommerce: from n/a through <= 3.0.2.
- Product
- Order Limit for WooCommerce
- Affected
- up to 3.0.2
- What to do
- Affects up to 3.0.2. Update Order Limit for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Booknetic: Cross-Site Request Forgery (CSRF)CVE-2025-26926 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Booknetic Booknetic booknetic allows Cross Site Request Forgery.This issue affects Booknetic: from n/a before 5.10.4.
- Product
- Booknetic
- Fixed in
- 5.10.4
- What to do
- Update Booknetic to 5.10.4 or newer.
Feb 25, 2025Wishlist: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-26915 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PickPlugins Wishlist wishlist allows SQL Injection.This issue affects Wishlist: from n/a through <= 1.0.41.
- Product
- Wishlist
- Affected
- up to 1.0.41
- What to do
- Affects up to 1.0.41. Update Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025AR For: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26913 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webandprint AR For WordPress ar-for-wordpress allows DOM-Based XSS.This issue affects AR For WordPress: from n/a through <= 7.7.
- Product
- AR For
- Affected
- up to 7.7
- What to do
- Affects up to 7.7. Update AR For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Easy Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26912 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons allows Stored XSS.This issue affects Easy Elementor Addons: from n/a through <= 2.1.6.
- Product
- Easy Elementor Addons
- Affected
- up to 2.1.6
- What to do
- Affects up to 2.1.6. Update Easy Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025System Dashboard: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-26911 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Bowo System Dashboard system-dashboard allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects System Dashboard: from n/a through <= 2.8.18.
- Product
- System Dashboard
- Affected
- up to 2.8.18
- What to do
- Affects up to 2.8.18. Update System Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Mortgage Calculator Estatik: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26907 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Estatik Mortgage Calculator Estatik estatik-mortgage-calculator allows Stored XSS.This issue affects Mortgage Calculator Estatik: from n/a through <= 2.0.12.
- Product
- Mortgage Calculator Estatik
- Affected
- up to 2.0.12
- What to do
- Affects up to 2.0.12. Update Mortgage Calculator Estatik to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Estatik: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-26905 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Estatik Estatik estatik allows PHP Local File Inclusion.This issue affects Estatik: from n/a through <= 4.3.0.
- Product
- Estatik
- Affected
- up to 4.3.0
- What to do
- Affects up to 4.3.0. Update Estatik to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025WP Responsive Auto Fit Text: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26904 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gal_op WP Responsive Auto Fit Text wp-responsive-slab-text allows DOM-Based XSS.This issue affects WP Responsive Auto Fit Text: from n/a through <= 0.2.
- Product
- WP Responsive Auto Fit Text
- Affected
- up to 0.2
- What to do
- Affects up to 0.2. Update WP Responsive Auto Fit Text to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Flexmls® IDX: Deserialization of Untrusted DataCVE-2025-26900 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in flexmls Flexmls® IDX flexmls-idx allows Object Injection.This issue affects Flexmls® IDX: from n/a through <= 3.14.27.
- Product
- Flexmls® IDX
- Affected
- up to 3.14.27
- What to do
- Affects up to 3.14.27. Update Flexmls® IDX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025List Related Attachments: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26897 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Baden List Related Attachments list-related-attachments-widget allows DOM-Based XSS.This issue affects List Related Attachments: from n/a through <= 2.1.6.
- Product
- List Related Attachments
- Affected
- up to 2.1.6
- What to do
- Affects up to 2.1.6. Update List Related Attachments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025PiwigoPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26896 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vpiwigo PiwigoPress piwigopress allows Stored XSS.This issue affects PiwigoPress: from n/a through <= 2.33.
- Product
- PiwigoPress
- Affected
- up to 2.33
- What to do
- Affects up to 2.33. Update PiwigoPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Easy Charts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26893 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kiran Potphode Easy Charts easy-charts allows DOM-Based XSS.This issue affects Easy Charts: from n/a through <= 1.2.3.
- Product
- Easy Charts
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Easy Charts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Ibtana: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26891 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VW THEMES Ibtana ibtana-visual-editor allows Stored XSS.This issue affects Ibtana: from n/a through <= 1.2.5.9.
- Product
- Ibtana
- Affected
- up to 1.2.5.9
- What to do
- Affects up to 1.2.5.9. Update Ibtana to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025EZ SQL Reports Shortcode Widget and DB Backup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26887 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eli EZ SQL Reports Shortcode Widget and DB Backup elisqlreports allows Stored XSS.This issue affects EZ SQL Reports Shortcode Widget and DB Backup: from n/a through <= 5.21.35.
- Product
- EZ SQL Reports Shortcode Widget and DB Backup
- Affected
- up to 5.21.35
- What to do
- Affects up to 5.21.35. Update EZ SQL Reports Shortcode Widget and DB Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Greenshift: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26884 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpsoul Greenshift greenshift-animation-and-page-builder-blocks allows Stored XSS.This issue affects Greenshift: from n/a through <= 10.8.
- Product
- Greenshift
- Affected
- up to 10.8
- What to do
- Affects up to 10.8. Update Greenshift to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Popup Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26882 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Popup Builder easy-notify-lite allows Stored XSS.This issue affects Popup Builder: from n/a through <= 1.1.33.
- Product
- Popup Builder
- Affected
- up to 1.1.33
- What to do
- Affects up to 1.1.33. Update Popup Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Sticky Content: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26881 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Sticky Content sticky-menu-block allows Stored XSS.This issue affects Sticky Content: from n/a through <= 1.0.1.
- Product
- Sticky Content
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Sticky Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Autoship Cloud for WooCommerce Subscription Products: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26878 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in patternsinthecloud Autoship Cloud for WooCommerce Subscription Products autoship-cloud allows DOM-Based XSS.This issue affects Autoship Cloud for WooCommerce Subscription Products: from n/a through <= 2.8.0.1.
- Product
- Autoship Cloud for WooCommerce Subscription Products
- Affected
- up to 2.8.0.1
- What to do
- Affects up to 2.8.0.1. Update Autoship Cloud for WooCommerce Subscription Products to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Front End Users: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26877 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rustaurius Front End Users front-end-only-users allows Stored XSS.This issue affects Front End Users: from n/a through <= 3.2.30.
- Product
- Front End Users
- Affected
- up to 3.2.30
- What to do
- Affects up to 3.2.30. Update Front End Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Search with Typesense: Path Traversal: '.../...//'CVE-2025-26876 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Path Traversal: '.../...//' vulnerability in CodeManas Search with Typesense search-with-typesense allows Path Traversal.This issue affects Search with Typesense: from n/a through <= 2.0.8.
- Product
- Search with Typesense
- Affected
- up to 2.0.8
- What to do
- Affects up to 2.0.8. Update Search with Typesense to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Essential Blocks for Gutenberg: Missing AuthorizationCVE-2025-26871 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg essential-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Blocks for Gutenberg: from n/a through <= 4.8.3.
- Product
- Essential Blocks for Gutenberg
- Affected
- up to 4.8.3
- What to do
- Affects up to 4.8.3. Update Essential Blocks for Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Fast Flow: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26868 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fastflow Fast Flow fast-flow-dashboard allows Reflected XSS.This issue affects Fast Flow: from n/a through <= 1.2.16.
- Product
- Fast Flow
- Affected
- up to 1.2.16
- What to do
- Affects up to 1.2.16. Update Fast Flow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Broadcast Live Video: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-26753 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in videowhisper Broadcast Live Video videowhisper-live-streaming-integration allows Path Traversal.This issue affects Broadcast Live Video: from n/a through <= 6.2.
- Product
- Broadcast Live Video
- Affected
- up to 6.2
- What to do
- Affects up to 6.2. Update Broadcast Live Video to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Broadcast Live Video: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-26752 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in videowhisper Broadcast Live Video videowhisper-live-streaming-integration allows Path Traversal.This issue affects Broadcast Live Video: from n/a through <= 6.2.
- Product
- Broadcast Live Video
- Affected
- up to 6.2
- What to do
- Affects up to 6.2. Update Broadcast Live Video to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Alphabetic Pagination: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26751 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fahad Mahmood Alphabetic Pagination alphabetic-pagination allows Reflected XSS.This issue affects Alphabetic Pagination: from n/a through <= 3.2.1.
- Product
- Alphabetic Pagination
- Affected
- up to 3.2.1
- What to do
- Affects up to 3.2.1. Update Alphabetic Pagination to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Elementor Website Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54444 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Stored XSS.This issue affects Elementor Website Builder: from n/a through <= 3.25.10.
- Product
- Elementor Website Builder
- Affected
- up to 3.25.10
- What to do
- Affects up to 3.25.10. Update Elementor Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Advanced Google reCaptcha: CAPTCHA BypassCVE-2025-1262 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Advanced Google reCaptcha plugin for WordPress is vulnerable to CAPTCHA Bypass in versions up to, and including, 1.27 . This makes it possible for unauthenticated attackers to bypass the Built-in Math Captcha Verification.
- Product
- Advanced Google reCaptcha
- Affected
- up to 1.27
- What to do
- Affects up to 1.27. Update Advanced Google reCaptcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 25, 2025Enfold: Server-Side Request ForgeryCVE-2024-13695 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Enfold theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.9 via the 'attachment_id' parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- Product
- Enfold
- Affected
- up to 6.0.9
- What to do
- Affects up to 6.0.9. Update Enfold to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Feb 25, 2025Enfold: Unauthorized access of dataCVE-2024-13693 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Enfold theme for WordPress is vulnerable to unauthorized access of data due to a missing capability check in avia-export-class.php in all versions up to, and including, 6.0.9. This makes it possible for unauthenticated attackers to export all avia settings which may included sensitive information such as the Mailchimp API Key, reCAPTCHA Secret Key, or Envato private token if they are set.
- Product
- Enfold
- Affected
- up to 6.0.9
- What to do
- Affects up to 6.0.9. Update Enfold to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Feb 25, 2025WordPress File Upload: Cross-Site Request ForgeryCVE-2024-13494 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WordPress File Upload plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.25.2. This is due to missing or incorrect nonce validation on the 'wfu_file_details' function. This makes it possible for unauthenticated attackers to modify user data details associated with uploaded files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- WordPress File Upload
- Affected
- up to 4.25.2
- What to do
- Affects up to 4.25.2. Update WordPress File Upload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 25, 2025Yawave: SQL InjectionCVE-2025-1648 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Yawave plugin for WordPress is vulnerable to SQL Injection via the 'lbid' parameter in all versions up to, and including, 2.9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Yawave
- Affected
- up to 2.9.1
- What to do
- Affects up to 2.9.1. Update Yawave to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordatviksecurity.complugins.trac.wordpress.org
Feb 25, 2025Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for: Arbitrary file upload, read, and deletionCVE-2025-1128 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file upload, read, and deletion due to missing file type and path validation in the 'format' method of the EVF_Form_Fields_Upload class in all versions up to, and including, 3.0.9.4. This makes it possible for unauthenticated attackers to upload, read, and delete arbitrary files on the affected site's server which may make remote code execution, sensitive information disclosure, or a site takeover possible.
- Product
- Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for
- Affected
- up to 3.0.9.4
- What to do
- Affects up to 3.0.9.4. Update Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Classified Listing – Classified ads & Business Directory: Sensitive Information ExposureCVE-2025-1063 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.4 via the rtcl_taxonomy_settings_export function. This makes it possible for unauthenticated attackers to extract sensitive data including API keys and tokens.
- Product
- Classified Listing – Classified ads & Business Directory
- Affected
- up to 4.0.4
- What to do
- Affects up to 4.0.4. Update Classified Listing – Classified ads & Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 25, 2025Photo Gallery, Sliders, Proofing and: Does not sanitise and escape some of its Image settingsCVE-2024-10545 · WordPress plugins & themes · reported by WPScanLow 3.5
The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.9 does not sanitise and escape some of its Image settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Photo Gallery, Sliders, Proofing and
- Fixed in
- 3.59.9
- What to do
- Update Photo Gallery, Sliders, Proofing and to 3.59.9 or newer.
Feb 24, 2025Önceki Yazı Link: Cross-Site Request Forgery (CSRF)CVE-2025-27357 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Musa AVCI Önceki Yazı Link onceki-yazi-linki allows Cross Site Request Forgery.This issue affects Önceki Yazı Link: from n/a through <= 1.3.
- Product
- Önceki Yazı Link
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Önceki Yazı Link to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 24, 2025Sticky Header On Scroll: Missing AuthorizationCVE-2025-27356 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Hardik Sticky Header On Scroll sticky-header-on-scroll allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sticky Header On Scroll: from n/a through <= 1.0.
- Product
- Sticky Header On Scroll
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Sticky Header On Scroll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 24, 2025Woocommerce – Loi Hamon: Cross-Site Request Forgery (CSRF)CVE-2025-27355 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Nicolas GRILLET Woocommerce – Loi Hamon loi-hamon allows Stored XSS.This issue affects Woocommerce – Loi Hamon: from n/a through <= 1.1.0.
- Product
- Woocommerce – Loi Hamon
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Woocommerce – Loi Hamon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 24, 2025Namaste! LMS: Cross-Site Request Forgery (CSRF)CVE-2025-27353 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Bob Namaste! LMS namaste-lms allows Cross Site Request Forgery.This issue affects Namaste! LMS: from n/a through <= 2.6.5.
- Product
- Namaste! LMS
- Affected
- up to 2.6.5
- What to do
- Affects up to 2.6.5. Update Namaste! LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 24, 2025无觅相关文章插件: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27352 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wumii team 无觅相关文章插件 wumii-related-posts allows Stored XSS.This issue affects 无觅相关文章插件: from n/a through <= 1.0.5.7.
- Product
- 无觅相关文章插件
- Affected
- up to 1.0.5.7
- What to do
- Affects up to 1.0.5.7. Update 无觅相关文章插件 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 24, 2025Local Search SEO Contact Page: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27351 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpertBusinessSearch Local Search SEO Contact Page local-search-seo-contact-page allows Stored XSS.This issue affects Local Search SEO Contact Page: from n/a through <= 4.0.1.
- Product
- Local Search SEO Contact Page
- Affected
- up to 4.0.1
- What to do
- Affects up to 4.0.1. Update Local Search SEO Contact Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 24, 2025Get Posts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27349 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nurelm Get Posts nurelm-get-posts allows Stored XSS.This issue affects Get Posts: from n/a through <= 0.6.
- Product
- Get Posts
- Affected
- up to 0.6
- What to do
- Affects up to 0.6. Update Get Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 24, 2025WP Social SEO Booster – Knowledge Graph Social Signals SEO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27348 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daniel WP Social SEO Booster – Knowledge Graph Social Signals SEO wp-social-seo-booster allows Stored XSS.This issue affects WP Social SEO Booster – Knowledge Graph Social Signals SEO: from n/a through <= 1.2.0.
- Product
- WP Social SEO Booster – Knowledge Graph Social Signals SEO
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update WP Social SEO Booster – Knowledge Graph Social Signals SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 24, 2025Direct Checkout Button for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27347 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in techmix Direct Checkout Button for WooCommerce woo-direct-checkout-button allows Stored XSS.This issue affects Direct Checkout Button for WooCommerce: from n/a through <= 1.0.
- Product
- Direct Checkout Button for WooCommerce
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Direct Checkout Button for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 24, 2025Phee's LinkPreview: Cross-Site Request Forgery (CSRF)CVE-2025-27344 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in filipstepanov Phee's LinkPreview linkpreview allows Cross Site Request Forgery.This issue affects Phee's LinkPreview: from n/a through <= 1.6.7.
- Product
- Phee's LinkPreview
- Affected
- up to 1.6.7
- What to do
- Affects up to 1.6.7. Update Phee's LinkPreview to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 24, 2025WooCommerce Recargo de Equivalencia: Cross-Site Request Forgery (CSRF)CVE-2025-27342 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in josesan WooCommerce Recargo de Equivalencia woo-recargo-de-equivalencia allows Cross Site Request Forgery.This issue affects WooCommerce Recargo de Equivalencia: from n/a through <= 1.6.24.
- Product
- WooCommerce Recargo de Equivalencia
- Affected
- up to 1.6.24
- What to do
- Affects up to 1.6.24. Update WooCommerce Recargo de Equivalencia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.