Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

542new WordPress flaws this week

391,528entries in the database

4,275 results · page 45 of 86

May 19, 2025Embed and Integrate Etsy Shop: Missing AuthorizationCVE-2025-48346 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Embed360 Embed and Integrate Etsy Shop embed-and-integrate-etsy-shop allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Embed and Integrate Etsy Shop: from n/a through <= 1.0.8.
Product
Embed and Integrate Etsy Shop
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Embed and Integrate Etsy Shop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Majestic Support: Missing AuthorizationCVE-2025-48282 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Majestic Support Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through <= 1.1.0.
Product
Majestic Support
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Majestic Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025WP Job Portal: Missing AuthorizationCVE-2025-48272 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wpjobportal WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through <= 2.3.2.
Product
WP Job Portal
Affected
up to 2.3.2
What to do
Affects up to 2.3.2. Update WP Job Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Bot for Telegram on WooCommerce: Missing AuthorizationCVE-2025-48268 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Guru Team Bot for Telegram on WooCommerce bot-for-telegram-on-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bot for Telegram on WooCommerce: from n/a through <= 1.2.6.
Product
Bot for Telegram on WooCommerce
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update Bot for Telegram on WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Url Rewrite Analyzer: Missing AuthorizationCVE-2025-48262 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in M.Code Url Rewrite Analyzer url-rewrite-analyzer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Url Rewrite Analyzer: from n/a through <= 1.3.3.
Product
Url Rewrite Analyzer
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Url Rewrite Analyzer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025GDPR CCPA Compliance Support: Missing AuthorizationCVE-2025-48260 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Ninja Team GDPR CCPA Compliance Support ninja-gdpr-compliance allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GDPR CCPA Compliance Support: from n/a through <= 2.7.3.
Product
GDPR CCPA Compliance Support
Affected
up to 2.7.3
What to do
Affects up to 2.7.3. Update GDPR CCPA Compliance Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Projectopia: Missing AuthorizationCVE-2025-48257 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Projectopia Projectopia projectopia-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Projectopia: from n/a through <= 5.1.17.
Product
Projectopia
Affected
up to 5.1.17
What to do
Affects up to 5.1.17. Update Projectopia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Shortlinks by Pretty Links: Missing AuthorizationCVE-2025-48247 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Blair Williams Shortlinks by Pretty Links pretty-link allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shortlinks by Pretty Links: from n/a through <= 3.6.15.
Product
Shortlinks by Pretty Links
Affected
up to 3.6.15
What to do
Affects up to 3.6.15. Update Shortlinks by Pretty Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025The Events Calendar: Missing AuthorizationCVE-2025-48246 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Events Calendar: from n/a through <= 6.11.2.1.
Product
The Events Calendar
Affected
up to 6.11.2.1
What to do
Affects up to 6.11.2.1. Update The Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Legal Pages: Missing AuthorizationCVE-2025-48242 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in wpWax Legal Pages legal-pages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Legal Pages: from n/a through <= 1.4.5.
Product
Legal Pages
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update Legal Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025BERTHA AI: Missing AuthorizationCVE-2025-48138 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Bertha AI – Andrew Palmer BERTHA AI bertha-ai-free allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BERTHA AI: from n/a through <= 1.13.
Product
BERTHA AI
Affected
up to 1.13
What to do
Affects up to 1.13. Update BERTHA AI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025Sharespine Woocommerce Connector: Missing AuthorizationCVE-2025-48128 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Sharespine Sharespine Woocommerce Connector sharespine-woocommerce-connector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sharespine Woocommerce Connector: from n/a through <= 4.7.55.
Product
Sharespine Woocommerce Connector
Affected
up to 4.7.55
What to do
Affects up to 4.7.55. Update Sharespine Woocommerce Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025Push notification for Mobile and Web app: Missing AuthorizationCVE-2025-48127 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in App Cheap Push notification for Mobile and Web app push-notification-mobile-and-web-app allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Push notification for Mobile and Web app: from n/a through <= 2.0.3.
Product
Push notification for Mobile and Web app
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update Push notification for Mobile and Web app to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025WooCommerce POS: Missing AuthorizationCVE-2025-48117 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in kilbot WooCommerce POS woocommerce-pos allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce POS: from n/a through <= 1.7.8.
Product
WooCommerce POS
Affected
up to 1.7.8
What to do
Affects up to 1.7.8. Update WooCommerce POS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025EventON: Missing AuthorizationCVE-2025-48116 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Ashan Perera EventON eventon-lite allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects EventON: from n/a through <= 2.4.4.
Product
EventON
Affected
up to 2.4.4
What to do
Affects up to 2.4.4. Update EventON to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025ProfileGrid: Missing AuthorizationCVE-2025-48079 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfileGrid : from n/a through <= 5.9.5.1.
Product
ProfileGrid
Affected
up to 5.9.5.1
What to do
Affects up to 5.9.5.1. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025EventON: Missing AuthorizationCVE-2025-47564 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ashanjay EventON eventon allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects EventON: from n/a through <= 4.9.8.
Product
EventON
Affected
up to 4.9.8
What to do
Affects up to 4.9.8. Update EventON to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025CURCY: Missing AuthorizationCVE-2025-47563 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in villatheme CURCY woocommerce-multi-currency allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects CURCY: from n/a through <= 2.3.7.
Product
CURCY
Affected
up to 2.3.7
What to do
Affects up to 2.3.7. Update CURCY to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025MapSVG: Missing AuthorizationCVE-2025-47560 · WordPress plugins & themes · reported by PatchstackMedium 5
Missing Authorization vulnerability in RomanCode MapSVG mapsvg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MapSVG: from n/a through < 8.6.13.
Product
MapSVG
What to do
Update MapSVG to the newest version.
Full record and what to do →NVD record patchstack.com
May 16, 2025CSS3 Compare Pricing Tables for: Missing AuthorizationCVE-2025-47556 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in QuanticaLabs CSS3 Compare Pricing Tables for WordPress css3_web_pricing_tables_grids allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CSS3 Compare Pricing Tables for WordPress: from n/a through <= 11.6.
Product
CSS3 Compare Pricing Tables for
Affected
up to 11.6
What to do
Affects up to 11.6. Update CSS3 Compare Pricing Tables for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025Wordpress Auto Spinner: Missing AuthorizationCVE-2025-47534 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ValvePress Wordpress Auto Spinner wp-auto-spinner allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wordpress Auto Spinner: from n/a through <= 3.25.0.
Product
Wordpress Auto Spinner
Affected
up to 3.25.0
What to do
Affects up to 3.25.0. Update Wordpress Auto Spinner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025Pinterest Automatic Pin: Missing AuthorizationCVE-2025-39511 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ValvePress Pinterest Automatic Pin wp-pinterest-automatic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pinterest Automatic Pin: from n/a through <= 4.19.0.
Product
Pinterest Automatic Pin
Affected
up to 4.19.0
What to do
Affects up to 4.19.0. Update Pinterest Automatic Pin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025Rankie: Missing AuthorizationCVE-2025-39493 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ValvePress Rankie valvepress-rankie allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rankie: from n/a through < 1.8.2.
Product
Rankie
Fixed in
1.8.2
What to do
Update Rankie to 1.8.2 or newer.
Full record and what to do →NVD record patchstack.com
May 16, 2025Eventer: Missing AuthorizationCVE-2025-39482 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in imithemes Eventer eventer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eventer: from n/a through < 3.11.4.
Product
Eventer
Affected
up to 3.9.6
What to do
Affects up to 3.9.6. Update Eventer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025Simple Link Directory: Missing AuthorizationCVE-2025-32296 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in quantumcloud Simple Link Directory qc-simple-link-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Link Directory: from n/a through < 14.8.1.
Product
Simple Link Directory
What to do
Update Simple Link Directory to the newest version.
Full record and what to do →NVD record patchstack.com
May 16, 2025Salon Booking Pro: Missing AuthorizationCVE-2025-32295 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wordpresschef Salon Booking Pro salon-booking-plugin-pro-cc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salon Booking Pro: from n/a through <= 10.10.2.
Product
Salon Booking Pro
Affected
up to 10.10.2
What to do
Affects up to 10.10.2. Update Salon Booking Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025CSS3 Accordions for: Missing AuthorizationCVE-2025-31923 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in QuanticaLabs CSS3 Accordions for WordPress css3_accordions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CSS3 Accordions for WordPress: from n/a through <= 3.0.
Product
CSS3 Accordions for
Affected
up to 3.0
What to do
Affects up to 3.0. Update CSS3 Accordions for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025The Business: Missing AuthorizationCVE-2025-31630 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in themeton The Business allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects The Business: from n/a through 1.6.1.
Product
The Business
Affected
up to 1.6.1
What to do
Affects up to 1.6.1. Update The Business to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025HotStar – Multi-Purpose Business: Missing AuthorizationCVE-2025-31071 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in themeton HotStar – Multi-Purpose Business Theme allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects HotStar – Multi-Purpose Business Theme: from n/a through 1.4.
Product
HotStar – Multi-Purpose Business
Affected
up to 1.4
What to do
Affects up to 1.4. Update HotStar – Multi-Purpose Business to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025Acerola: Missing AuthorizationCVE-2025-31066 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in themeton Acerola acerola allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Acerola: from n/a through <= 1.6.5.
Product
Acerola
Affected
up to 1.6.5
What to do
Affects up to 1.6.5. Update Acerola to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025Rozario: Missing AuthorizationCVE-2025-31065 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in themeton Rozario allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Rozario: from n/a through 1.4.
Product
Rozario
Affected
up to 1.4
What to do
Affects up to 1.4. Update Rozario to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025Wishlist: Missing AuthorizationCVE-2025-31063 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in redqteam Wishlist wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wishlist: from n/a through <= 2.1.0.
Product
Wishlist
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 15, 2025WP-PManager: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2025-2248 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP-PManager WordPress plugin through 1.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
Product
WP-PManager
Affected
up to 1.2
What to do
Affects up to 1.2. Update WP-PManager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
May 15, 2025FunnelKit: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2025-2203 · WordPress plugins & themes · reported by WPScanMedium 6.1
The FunnelKit WordPress plugin before 3.10.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
Product
FunnelKit
Fixed in
3.10.2
What to do
Update FunnelKit to 3.10.2 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Melapress File Monitor: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-9879 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Melapress File Monitor WordPress plugin before 2.1.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
Product
Melapress File Monitor
Fixed in
2.1.1
What to do
Update Melapress File Monitor to 2.1.1 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Auto Affiliate Links: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-9838 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Auto Affiliate Links WordPress plugin before 6.4.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
Product
Auto Affiliate Links
Fixed in
6.4.7
What to do
Update Auto Affiliate Links to 6.4.7 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Taskbuilder: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-9831 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Taskbuilder WordPress plugin before 3.0.9 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
Product
Taskbuilder
Fixed in
3.0.9
What to do
Update Taskbuilder to 3.0.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Simple Video Directory: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-6809 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Simple Video Directory WordPress plugin before 1.4.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
Product
Simple Video Directory
Fixed in
1.4.3
What to do
Update Simple Video Directory to 1.4.3 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Push Notification for Post and BuddyPress: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-6159 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Push Notification for Post and BuddyPress WordPress plugin before 1.9.4 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
Product
Push Notification for Post and BuddyPress
Fixed in
1.9.4
What to do
Update Push Notification for Post and BuddyPress to 1.9.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Advance Post Prefix: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-12735 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Advance Post Prefix WordPress plugin through 1.1.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins and above to perform SQL injection attacks
Product
Advance Post Prefix
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Advance Post Prefix to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Connexion Logs: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-11372 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Connexion Logs WordPress plugin through 3.0.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
Product
Connexion Logs
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update Connexion Logs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025AHAthat: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-11269 · WordPress plugins & themes · reported by WPScanHigh 7.2
The AHAthat Plugin WordPress plugin through 1.6 does not sanitize and escape a parameter before using it in a SQL statement, allowing Admin to perform SQL injection attacks.
Product
AHAthat
Affected
up to 1.6
What to do
Affects up to 1.6. Update AHAthat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025JSP Store Locator: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-11267 · WordPress plugins & themes · reported by WPScanHigh 8.8
The JSP Store Locator WordPress plugin through 1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing user with Contributor to perform SQL injection attacks.
Product
JSP Store Locator
Affected
up to 1.0
What to do
Affects up to 1.0. Update JSP Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Sailthru Triggermail: Does not sanitise and escape some of its settings and is missing CSRF protectionCVE-2024-11141 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Sailthru Triggermail WordPress plugin through 1.1 does not sanitise and escape some of its settings and is missing CSRF protection which could allow subscribers to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Sailthru Triggermail
Affected
up to 1.1
What to do
Affects up to 1.1. Update Sailthru Triggermail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Melapress File Monitor: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-10009 · WordPress plugins & themes · reported by WPScanMedium 4.1
The Melapress File Monitor WordPress plugin before 2.1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
Product
Melapress File Monitor
Fixed in
2.1.0
What to do
Update Melapress File Monitor to 2.1.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Jetpack Debug Tools: Missing AuthorizationCVE-2024-56006 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Automattic Jetpack Debug Tools.This issue affects Jetpack Debug Tools: from n/a before 2.0.1.
Product
Jetpack Debug Tools
Fixed in
2.0.1
What to do
Update Jetpack Debug Tools to 2.0.1 or newer.
Full record and what to do →NVD record patchstack.com
May 15, 2025Tours: Missing AuthorizationCVE-2024-51666 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Tosin Oguntuyi Tours tours.This issue affects Tours: from n/a through <= 1.0.0.
Product
Tours
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Tours to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 15, 2025Front End Users: Missing AuthorizationCVE-2025-47580 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Rustaurius Front End Users front-end-only-users allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Front End Users: from n/a through <= 3.2.35.
Product
Front End Users
Affected
up to 3.2.35
What to do
Affects up to 3.2.35. Update Front End Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025Contentstudio: Missing AuthorizationCVE-2025-47692 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in contentstudio Contentstudio contentstudio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contentstudio: from n/a through <= 1.3.5.
Product
Contentstudio
Affected
up to 1.3.5
What to do
Affects up to 1.3.5. Update Contentstudio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025Advanced File Manager: Missing AuthorizationCVE-2025-47688 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Saad Iqbal Advanced File Manager file-manager-advanced allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced File Manager: from n/a through <= 5.3.1.
Product
Advanced File Manager
Affected
up to 5.3.1
What to do
Affects up to 5.3.1. Update Advanced File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.