Vulnerability database

3,807 results · page 42 of 77

• May 23, 2025Crossword Compiler Puzzles: Unrestricted Upload of File with Dangerous TypeCVE-2025-46490 · WordPress plugins & themes · reported by PatchstackCritical 9.9

  Unrestricted Upload of File with Dangerous Type vulnerability in wordwebsoftware Crossword Compiler Puzzles crossword-compiler-puzzles allows Upload a Web Shell to a Web Server.This issue affects Crossword Compiler Puzzles: from n/a through <= 5.2.

  Product

  Crossword Compiler Puzzles

  Affected

  up to 5.2

  What to do

  Affects up to 5.2. Update Crossword Compiler Puzzles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 23, 2025SEUR Oficial: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-46474 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in SEUR OFICIAL SEUR Oficial seur allows PHP Local File Inclusion.This issue affects SEUR Oficial: from n/a through <= 2.2.23.

  Product

  SEUR Oficial

  Affected

  up to 2.2.23

  What to do

  Affects up to 2.2.23. Update SEUR Oficial to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 23, 2025Fable Extra: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-46468 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WPFable Fable Extra fable-extra allows PHP Local File Inclusion.This issue affects Fable Extra: from n/a through <= 1.0.6.

  Product

  Fable Extra

  Affected

  up to 1.0.6

  What to do

  Affects up to 1.0.6. Update Fable Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 23, 2025Meta Keywords & Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-46454 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in svil4ok Meta Keywords & Description wp-meta-keywords-meta-description allows PHP Local File Inclusion.This issue affects Meta Keywords & Description: from n/a through <= 0.8.

  Product

  Meta Keywords & Description

  Affected

  up to 0.8

  What to do

  Affects up to 0.8. Update Meta Keywords & Description to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 23, 2025Ads Pro: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-46444 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in scripteo Ads Pro ap-plugin-scripteo allows PHP Local File Inclusion.This issue affects Ads Pro: from n/a through <= 4.89.

  Product

  Ads Pro

  Affected

  up to 4.89

  What to do

  Affects up to 4.89. Update Ads Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 23, 2025Nasa Core: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39506 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in NasaTheme Nasa Core nasa-core allows PHP Local File Inclusion.This issue affects Nasa Core: from n/a through <= 6.3.2.

  Product

  Nasa Core

  Affected

  up to 6.3.2

  What to do

  Affects up to 6.3.2. Update Nasa Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 23, 2025Wilmër: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39494 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Wilmër wilmer allows PHP Local File Inclusion.This issue affects Wilmër: from n/a through < 3.4.2.

  Product

  Wilmër

  Fixed in

  3.4.2

  What to do

  Update Wilmër to 3.4.2 or newer.

  Full record and what to do →NVD recordpatchstack.com

• May 23, 2025Backpack Traveler: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39490 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Backpack Traveler backpacktraveler allows PHP Local File Inclusion.This issue affects Backpack Traveler: from n/a through <= 2.10.2.

  Product

  Backpack Traveler

  Affected

  up to 2.10.2

  What to do

  Affects up to 2.10.2. Update Backpack Traveler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 23, 2025Healsoul: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32309 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Healsoul healsoul allows PHP Local File Inclusion.This issue affects Healsoul: from n/a through <= 2.2.3.

  Product

  Healsoul

  Affected

  up to 2.2.3

  What to do

  Affects up to 2.2.3. Update Healsoul to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 23, 2025Winnex: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32302 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Winnex winnex allows PHP Local File Inclusion.This issue affects Winnex: from n/a through <= 1.3.2.

  Product

  Winnex

  Affected

  up to 1.3.2

  What to do

  Affects up to 1.3.2. Update Winnex to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 23, 2025Oxpitan: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32294 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Oxpitan oxpitan allows PHP Local File Inclusion.This issue affects Oxpitan: from n/a through <= 1.3.5.

  Product

  Oxpitan

  Affected

  up to 1.3.5

  What to do

  Affects up to 1.3.5. Update Oxpitan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 23, 2025Yozi: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32289 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme Yozi yozi allows PHP Local File Inclusion.This issue affects Yozi: from n/a through <= 2.0.63.

  Product

  Yozi

  Affected

  up to 2.0.63

  What to do

  Affects up to 2.0.63. Update Yozi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 23, 2025Butcher: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32286 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme Butcher butcher allows PHP Local File Inclusion.This issue affects Butcher: from n/a through <= 2.40.

  Product

  Butcher

  Affected

  up to 2.40

  What to do

  Affects up to 2.40. Update Butcher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 23, 2025JP Students Result Management System Premium: Unrestricted Upload of File with Dangerous TypeCVE-2025-31916 · WordPress plugins & themes · reported by PatchstackCritical 9

  Unrestricted Upload of File with Dangerous Type vulnerability in joy2012bd JP Students Result Management System Premium allows Upload a Web Shell to a Web Server. This issue affects JP Students Result Management System Premium: from 1.1.7 through n/a.

  Product

  JP Students Result Management System Premium

  What to do

  Update JP Students Result Management System Premium to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• May 23, 2025Ogami: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-31913 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme Ogami ogami allows PHP Local File Inclusion.This issue affects Ogami: from n/a through <= 1.53.

  Product

  Ogami

  Affected

  up to 1.53

  What to do

  Affects up to 1.53. Update Ogami to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 23, 2025Enzio - Responsive Business: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-31912 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Enzio - Responsive Business WordPress Theme enzio allows PHP Local File Inclusion.This issue affects Enzio - Responsive Business WordPress Theme: from n/a through < 1.2.6.

  Product

  Enzio - Responsive Business

  What to do

  Update Enzio - Responsive Business to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• May 23, 2025Kiamo - Responsive Business Service: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-31633 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Kiamo - Responsive Business Service WordPress Theme allows PHP Local File Inclusion. This issue affects Kiamo - Responsive Business Service WordPress Theme: from n/a through 1.3.3.

  Product

  Kiamo - Responsive Business Service

  Affected

  up to 1.3.3

  What to do

  Affects up to 1.3.3. Update Kiamo - Responsive Business Service to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 23, 2025La Boom: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-31632 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in SpyroPress La Boom allows PHP Local File Inclusion. This issue affects La Boom: from n/a through 2.7.

  Product

  La Boom

  Affected

  up to 2.7

  What to do

  Affects up to 2.7. Update La Boom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 23, 2025Vizeon - Business Consulting: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-31064 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Vizeon - Business Consulting vizeon allows PHP Local File Inclusion.This issue affects Vizeon - Business Consulting: from n/a through < 1.2.1.

  Product

  Vizeon - Business Consulting

  What to do

  Update Vizeon - Business Consulting to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• May 23, 2025Capie: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-31060 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme Capie capie allows PHP Local File Inclusion.This issue affects Capie: from n/a through <= 1.0.40.

  Product

  Capie

  Affected

  up to 1.0.40

  What to do

  Affects up to 1.0.40. Update Capie to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 21, 2025Madara – Responsive and modern WordPress theme for manga sites: Local File InclusionCVE-2025-4524 · WordPress plugins & themes · reported by WordfenceCritical 9.8

  The Madara – Responsive and modern WordPress theme for manga sites theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.2.2 via the 'template' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

  Product

  Madara – Responsive and modern WordPress theme for manga sites

  Affected

  up to 2.2.2

  What to do

  Affects up to 2.2.2. Update Madara – Responsive and modern WordPress theme for manga sites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordmangabooth.comwordfence.com

• May 19, 2025User Profile Meta Manager: Cross-Site Request Forgery (CSRF)CVE-2025-48340 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Cross-Site Request Forgery (CSRF) vulnerability in Danny Vink User Profile Meta Manager user-profile-meta allows Privilege Escalation.This issue affects User Profile Meta Manager: from n/a through <= 1.02.

  Product

  User Profile Meta Manager

  Affected

  up to 1.02

  What to do

  Affects up to 1.02. Update User Profile Meta Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025WPAMS: Unrestricted Upload of File with Dangerous TypeCVE-2025-39402 · WordPress plugins & themes · reported by PatchstackCritical 9.9

  Unrestricted Upload of File with Dangerous Type vulnerability in mojoomla WPAMS apartment-management allows Upload a Web Shell to a Web Server.This issue affects WPAMS: from n/a through <= 44.0 (17-08-2023).

  Product

  WPAMS

  Affected

  up to 44.0

  What to do

  Affects up to 44.0. Update WPAMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025WPAMS: Unrestricted Upload of File with Dangerous TypeCVE-2025-39401 · WordPress plugins & themes · reported by PatchstackCritical 10

  Unrestricted Upload of File with Dangerous Type vulnerability in mojoomla WPAMS apartment-management allows Upload a Web Shell to a Web Server.This issue affects WPAMS: from n/a through <= 44.0 (17-08-2023).

  Product

  WPAMS

  Affected

  up to 44.0

  What to do

  Affects up to 44.0. Update WPAMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Hospital Management System: Unrestricted Upload of File with Dangerous TypeCVE-2025-39380 · WordPress plugins & themes · reported by PatchstackCritical 10

  Unrestricted Upload of File with Dangerous Type vulnerability in mojoomla Hospital Management System hospital-management allows Upload a Web Shell to a Web Server.This issue affects Hospital Management System: from n/a through <= 47.0(20-11-2023).

  Product

  Hospital Management System

  Affected

  up to 47.0

  What to do

  Affects up to 47.0. Update Hospital Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025SUMO Reward Points: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32925 · WordPress plugins & themes · reported by PatchstackHigh 8.3

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in FantasticPlugins SUMO Reward Points rewardsystem allows PHP Local File Inclusion.This issue affects SUMO Reward Points: from n/a through <= 30.7.0.

  Product

  SUMO Reward Points

  Affected

  up to 30.7.0

  What to do

  Affects up to 30.7.0. Update SUMO Reward Points to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025TI WooCommerce Wishlist: Unrestricted Upload of File with Dangerous TypeCVE-2025-47577 · WordPress plugins & themes · reported by PatchstackCritical 10

  Unrestricted Upload of File with Dangerous Type vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Upload a Web Shell to a Web Server.This issue affects TI WooCommerce Wishlist: from n/a through <= 2.9.2.

  Product

  TI WooCommerce Wishlist

  Affected

  up to 2.9.2

  What to do

  Affects up to 2.9.2. Update TI WooCommerce Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Foton: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39458 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Foton foton allows PHP Local File Inclusion.This issue affects Foton: from n/a through <= 2.5.2.

  Product

  Foton

  Affected

  up to 2.5.2

  What to do

  Affects up to 2.5.2. Update Foton to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025WhatsApp Click to Chat Plugin for: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39411 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Indie_Plugins WhatsApp Click to Chat Plugin for WordPress wpt-whatsapp.This issue affects WhatsApp Click to Chat Plugin for WordPress: from n/a through <= 2.2.12.

  Product

  WhatsApp Click to Chat Plugin for

  Affected

  up to 2.2.12

  What to do

  Affects up to 2.2.12. Update WhatsApp Click to Chat Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025WPAMS: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39406 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in mojoomla WPAMS apartment-management allows PHP Local File Inclusion.This issue affects WPAMS: from n/a through <= 44.0.

  Product

  WPAMS

  Affected

  up to 44.0

  What to do

  Affects up to 44.0. Update WPAMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025JetReviews: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39396 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Crocoblock JetReviews jet-reviews allows PHP Local File Inclusion.This issue affects JetReviews: from n/a through <= 2.3.6.

  Product

  JetReviews

  Affected

  up to 2.3.6

  What to do

  Affects up to 2.3.6. Update JetReviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Celestial Aura: Unrestricted Upload of File with Dangerous TypeCVE-2025-26892 · WordPress plugins & themes · reported by PatchstackCritical 9.9

  Unrestricted Upload of File with Dangerous Type vulnerability in dkszone Celestial Aura allows Using Malicious Files.This issue affects Celestial Aura: from n/a through 2.2.

  Product

  Celestial Aura

  Affected

  up to 2.2

  What to do

  Affects up to 2.2. Update Celestial Aura to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Eximius: Unrestricted Upload of File with Dangerous TypeCVE-2025-26872 · WordPress plugins & themes · reported by PatchstackCritical 9.9

  Unrestricted Upload of File with Dangerous Type vulnerability in dkszone Eximius allows Using Malicious Files.This issue affects Eximius: from n/a through 2.2.

  Product

  Eximius

  Affected

  up to 2.2

  What to do

  Affects up to 2.2. Update Eximius to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Grip: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-26735 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Candid themes Grip.This issue affects Grip: from n/a through 1.0.9.

  Product

  Grip

  Affected

  up to 1.0.9

  What to do

  Affects up to 1.0.9. Update Grip to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Bimber - Viral Magazine: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-47576 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Bringthepixel Bimber - Viral Magazine WordPress Theme.This issue affects Bimber - Viral Magazine WordPress Theme: from n/a through 9.2.5.

  Product

  Bimber - Viral Magazine

  Affected

  up to 9.2.5

  What to do

  Affects up to 9.2.5. Update Bimber - Viral Magazine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Product Category Slider for WooCommerce: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39364 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in PluginEver Product Category Slider for WooCommerce woo-category-slider-by-pluginever allows PHP Local File Inclusion.This issue affects Product Category Slider for WooCommerce: from n/a through <= 4.3.4.

  Product

  Product Category Slider for WooCommerce

  Affected

  up to 4.3.4

  What to do

  Affects up to 4.3.4. Update Product Category Slider for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 17, 2025Echo RSS Feed Post Generator: Arbitrary file uploadsCVE-2025-4391 · WordPress plugins & themes · reported by WordfenceCritical 9.8

  The Echo RSS Feed Post Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the echo_generate_featured_image() function in all versions up to, and including, 5.4.8.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

  Product

  Echo RSS Feed Post Generator

  Affected

  up to 5.4.8.1

  What to do

  Affects up to 5.4.8.1. Update Echo RSS Feed Post Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordcodecanyon.networdfence.com

• May 17, 2025Crawlomatic Multipage Scraper Post Generator: Arbitrary file uploadsCVE-2025-4389 · WordPress plugins & themes · reported by WordfenceCritical 9.8

  The Crawlomatic Multipage Scraper Post Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the crawlomatic_generate_featured_image() function in all versions up to, and including, 2.6.8.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

  Product

  Crawlomatic Multipage Scraper Post Generator

  Affected

  up to 2.6.8.1

  What to do

  Affects up to 2.6.8.1. Update Crawlomatic Multipage Scraper Post Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordcodecanyon.networdfence.com

• May 17, 2025CSV Mass Importer: Does not properly validate uploaded filesCVE-2025-4190 · WordPress plugins & themes · reported by WPScanHigh 7.2

  The CSV Mass Importer WordPress plugin through 1.2 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)

  Product

  CSV Mass Importer

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update CSV Mass Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• May 17, 2025WPBot Pro Wordpress Chatbot: Arbitrary file deletionCVE-2025-3812 · WordPress plugins & themes · reported by WordfenceHigh 8.1

  The WPBot Pro Wordpress Chatbot plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the qcld_openai_delete_training_file() function in all versions up to, and including, 13.6.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

  Product

  WPBot Pro Wordpress Chatbot

  Affected

  up to 13.6.2

  What to do

  Affects up to 13.6.2. Update WPBot Pro Wordpress Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwordfence.comwpbot.pro

• May 16, 2025Mortgage Calculator Estatik: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-48136 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Estatik Mortgage Calculator Estatik estatik-mortgage-calculator allows PHP Local File Inclusion.This issue affects Mortgage Calculator Estatik: from n/a through <= 2.0.12.

  Product

  Mortgage Calculator Estatik

  Affected

  up to 2.0.12

  What to do

  Affects up to 2.0.12. Update Mortgage Calculator Estatik to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 16, 2025ProfileGrid: Missing AuthorizationCVE-2025-48079 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfileGrid : from n/a through <= 5.9.5.1.

  Product

  ProfileGrid

  Affected

  up to 5.9.5.1

  What to do

  Affects up to 5.9.5.1. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 16, 2025FAT Services Booking: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-47693 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in roninwp FAT Services Booking fat-services-booking allows PHP Local File Inclusion.This issue affects FAT Services Booking: from n/a through <= 5.5.

  Product

  FAT Services Booking

  Affected

  up to 5.5

  What to do

  Affects up to 5.5. Update FAT Services Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 16, 2025Nasa Core: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39507 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in NasaTheme Nasa Core nasa-core allows PHP Local File Inclusion.This issue affects Nasa Core: from n/a through < 6.4.4.

  Product

  Nasa Core

  Affected

  up to 6.3.2

  What to do

  Affects up to 6.3.2. Update Nasa Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 15, 2025Melapress File Monitor: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-9879 · WordPress plugins & themes · reported by WPScanMedium 5.4

  The Melapress File Monitor WordPress plugin before 2.1.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks

  Product

  Melapress File Monitor

  Fixed in

  2.1.1

  What to do

  Update Melapress File Monitor to 2.1.1 or newer.

  Full record and what to do →NVD recordwpscan.com

• May 15, 2025The EKC Tournament Manager WordPress plugin before 2.2.2 allows a logged in admin to download system files outside of the WordPress directoryCVE-2024-9765 · WordPress plugins & themes · reported by WPScanMedium 6.5

  The EKC Tournament Manager WordPress plugin before 2.2.2 allows a logged in admin to download system files outside of the WordPress directory

  Product

  EKC Tournament Manager

  Fixed in

  2.2.2

  What to do

  Update EKC Tournament Manager to 2.2.2 or newer.

  Full record and what to do →NVD recordwpscan.com

• May 15, 2025AVIF Uploader: Does not sanitise uploaded SVG filesCVE-2024-9238 · WordPress plugins & themes · reported by WPScanMedium 5.4

  The AVIF Uploader WordPress plugin before 1.1.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.

  Product

  AVIF Uploader

  Fixed in

  1.1.1

  What to do

  Update AVIF Uploader to 1.1.1 or newer.

  Full record and what to do →NVD recordwpscan.com

• May 15, 2025Z-Downloads: Does not properly validate files uploadedCVE-2024-8699 · WordPress plugins & themes · reported by WPScanHigh 7.2

  The Z-Downloads WordPress plugin before 1.11.5 does not properly validate files uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)

  Product

  Z-Downloads

  Fixed in

  1.11.5

  What to do

  Update Z-Downloads to 1.11.5 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• May 15, 2025Z-Downloads: Does not properly validate uploaded files allowing for the uploading of SVGs containing malicious JavaScriptCVE-2024-8673 · WordPress plugins & themes · reported by WPScanCritical 9.1

  The Z-Downloads WordPress plugin before 1.11.7 does not properly validate uploaded files allowing for the uploading of SVGs containing malicious JavaScript.

  Product

  Z-Downloads

  Fixed in

  1.11.7

  What to do

  Update Z-Downloads to 1.11.7 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• May 15, 2025Simple Job Board: Does not prevent uploaded files from being listedCVE-2024-7762 · WordPress plugins & themes · reported by WPScanLow 3.7

  The Simple Job Board WordPress plugin before 2.12.6 does not prevent uploaded files from being listed, allowing unauthenticated users to access and download uploaded resumes

  Product

  Simple Job Board

  Fixed in

  2.12.6

  What to do

  Update Simple Job Board to 2.12.6 or newer.

  Full record and what to do →NVD recordwpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.