Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
41,601 results · page 454 of 833
Jan 8, 2025WordPress Webinar Plugin – WebinarPress: Modification of dataCVE-2024-11271 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WordPress Webinar Plugin – WebinarPress plugin for WordPress is vulnerable to modification of data due to a missing capability check on several functions in all versions up to, and including, 1.33.24. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify webinars.
- Product
- WordPress Webinar Plugin – WebinarPress
- Affected
- up to 1.33.24
- What to do
- Affects up to 1.33.24. Update WordPress Webinar Plugin – WebinarPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 8, 2025WordPress Webinar Plugin – WebinarPress: Arbitrary file creationCVE-2024-11270 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WordPress Webinar Plugin – WebinarPress plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check on the 'sync-import-imgs' function and missing file type validation in all versions up to, and including, 1.33.24. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary files that can lead to remote code execution.
- Product
- WordPress Webinar Plugin – WebinarPress
- Affected
- up to 1.33.24
- What to do
- Affects up to 1.33.24. Update WordPress Webinar Plugin – WebinarPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 7, 2025SureForms – Drag and Drop Form Builder for: Information ExposureCVE-2024-12713 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.2 via the handle_export_form() function due to a missing capability check. This makes it possible for unauthenticated attackers to export data from password protected, private, or draft posts that they should not have access to.
- Product
- SureForms – Drag and Drop Form Builder for
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update SureForms – Drag and Drop Form Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 7, 2025Slotti Ajanvaraus: Stored Cross-Site ScriptingCVE-2024-12521 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Slotti Ajanvaraus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'slotti-embed-ga' shortcode in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Slotti Ajanvaraus
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Slotti Ajanvaraus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 7, 2025Easy Form Builder – WordPress plugin form builder: contact form, survey form, payment form, and custom form builder: Stored Cross-Site ScriptingCVE-2024-12112 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Easy Form Builder – WordPress plugin form builder: contact form, survey form, payment form, and custom form builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter of the 'add_form_Emsfb' AJAX action in all versions up to, and including, 3.8.8 due to insufficient input sanitization and output escaping and missing authorization checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Easy Form Builder – WordPress plugin form builder: contact form, survey form, payment form, and custom form builder
- Affected
- up to 3.8.8
- What to do
- Affects up to 3.8.8. Update Easy Form Builder – WordPress plugin form builder: contact form, survey form, payment form, and custom form builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 7, 2025The Ultimate WordPress Toolkit – WP Extended: Unauthorized modification and retrieval of dataCVE-2024-11916 · WordPress plugins & themes · reported by WordfenceHigh 7.4
The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification and retrieval of data due to a missing capability check on several functions in all versions up to, and including, 3.0.11. This makes it possible for authenticated attackers, with subscriber-level access and above, to import and activate arbitrary code snippets along with
- Product
- The Ultimate WordPress Toolkit – WP Extended
- Affected
- up to 3.0.11
- What to do
- Affects up to 3.0.11. Update The Ultimate WordPress Toolkit – WP Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 7, 2025Ultimate WordPress Toolkit – WP Extended: Remote Code Execution in version 3CVE-2024-11816 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Remote Code Execution in version 3.0.11. This is due to a missing capability check on the 'wpext_handle_snippet_update' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute code on the server providing an admin has created at least one code snippet.
- Product
- Ultimate WordPress Toolkit – WP Extended
- Fixed in
- 3.0.12
- What to do
- Update Ultimate WordPress Toolkit – WP Extended to 3.0.12 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 7, 2025Alpha Price Table For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22500 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ali Ali Alpha Price Table For Elementor alpha-price-table-for-elementor allows DOM-Based XSS.This issue affects Alpha Price Table For Elementor: from n/a through <= 1.2.0.
- Product
- Alpha Price Table For Elementor
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Alpha Price Table For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025EMC2 Alert Boxes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22365 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eric McNiece EMC2 Alert Boxes allows Stored XSS.This issue affects EMC2 Alert Boxes: from n/a through 1.3.
- Product
- EMC2 Alert Boxes
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update EMC2 Alert Boxes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Allada T-shirt Designer for Woocommerce: Missing AuthorizationCVE-2025-22363 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Hermann LAHAMI Allada T-shirt Designer for Woocommerce allada-tshirt-designer-for-woocommerce.This issue affects Allada T-shirt Designer for Woocommerce: from n/a through <= 1.1.
- Product
- Allada T-shirt Designer for Woocommerce
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Allada T-shirt Designer for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Digi Store: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22354 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Code Themes Digi Store allows DOM-Based XSS.This issue affects Digi Store: from n/a through 1.1.4.
- Product
- Digi Store
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update Digi Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Ultimate Learning Pro: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22350 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WpIndeed Ultimate Learning Pro allows SQL Injection.This issue affects Ultimate Learning Pro: from n/a through 3.9.
- Product
- Ultimate Learning Pro
- Affected
- up to 3.9
- What to do
- Affects up to 3.9. Update Ultimate Learning Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Education LMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22334 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FilaThemes Education LMS allows Stored XSS.This issue affects Education LMS: from n/a through 0.0.7.
- Product
- Education LMS
- Affected
- up to 0.0.7
- What to do
- Affects up to 0.0.7. Update Education LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Social Media Share Buttons | MashShare: Missing AuthorizationCVE-2025-22319 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in DearHive Social Media Share Buttons | MashShare.This issue affects Social Media Share Buttons | MashShare: from n/a through 4.0.47.
- Product
- Social Media Share Buttons | MashShare
- Affected
- up to 4.0.47
- What to do
- Affects up to 4.0.47. Update Social Media Share Buttons | MashShare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Link Whisper Free: Insertion of Sensitive Information into Externally-Accessible File or DirectoryCVE-2025-22306 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Spencer Haws Link Whisper Free link-whisper.This issue affects Link Whisper Free: from n/a through <= 0.7.7.
- Product
- Link Whisper Free
- Affected
- up to 0.7.7
- What to do
- Affects up to 0.7.7. Update Link Whisper Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Hash Elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22296 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Hash Elements hash-elements.This issue affects Hash Elements: from n/a through <= 1.5.0.
- Product
- Hash Elements
- Affected
- up to 1.5.0
- What to do
- Affects up to 1.5.0. Update Hash Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Hide Category by User Role for WooCommerce: Missing AuthorizationCVE-2024-56272 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ThemeSupport Hide Category by User Role for WooCommerce hide-category-by-user-role-for-woocommerce.This issue affects Hide Category by User Role for WooCommerce: from n/a through <= 2.1.1.
- Product
- Hide Category by User Role for WooCommerce
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Hide Category by User Role for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025WP SecureSubmit: Missing AuthorizationCVE-2024-56270 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in SecureSubmit WP SecureSubmit securesubmit allows Retrieve Embedded Sensitive Data.This issue affects WP SecureSubmit: from n/a through <= 1.5.20.
- Product
- WP SecureSubmit
- Affected
- up to 1.5.20
- What to do
- Affects up to 1.5.20. Update WP SecureSubmit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Laika Pedigree Tree: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22593 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in burria Laika Pedigree Tree laika-pedigree-tree allows Stored XSS.This issue affects Laika Pedigree Tree: from n/a through <= 1.4.
- Product
- Laika Pedigree Tree
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Laika Pedigree Tree to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 20251003 Mortgage Application: Missing AuthorizationCVE-2025-22592 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in 8blocks 1003 Mortgage Application 1003-mortgage-application allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects 1003 Mortgage Application: from n/a through <= 1.87.
- Product
- 1003 Mortgage Application
- Affected
- up to 1.87
- What to do
- Affects up to 1.87. Update 1003 Mortgage Application to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 20251003 Mortgage Application: Missing AuthorizationCVE-2025-22591 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in 8blocks 1003 Mortgage Application 1003-mortgage-application allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 1003 Mortgage Application: from n/a through <= 1.87.
- Product
- 1003 Mortgage Application
- Affected
- up to 1.87
- What to do
- Affects up to 1.87. Update 1003 Mortgage Application to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Prayer Times Anywhere: Cross-Site Request Forgery (CSRF)CVE-2025-22590 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in mmrs151 Prayer Times Anywhere prayer-times-anywhere allows Stored XSS.This issue affects Prayer Times Anywhere: from n/a through <= 2.0.1.
- Product
- Prayer Times Anywhere
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update Prayer Times Anywhere to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Quote Tweet: Cross-Site Request Forgery (CSRF)CVE-2025-22589 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in bozdoz Quote Tweet quote-tweet allows Stored XSS.This issue affects Quote Tweet: from n/a through <= 0.7.
- Product
- Quote Tweet
- Affected
- up to 0.7
- What to do
- Affects up to 0.7. Update Quote Tweet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Ultimate Image Hover Effects: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22585 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themebon Ultimate Image Hover Effects ultimate-image-hover-effects allows DOM-Based XSS.This issue affects Ultimate Image Hover Effects: from n/a through <= 1.1.2.
- Product
- Ultimate Image Hover Effects
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Ultimate Image Hover Effects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Timeline Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22584 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginsPoint Timeline Pro timeline-pro allows DOM-Based XSS.This issue affects Timeline Pro: from n/a through <= 1.3.
- Product
- Timeline Pro
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Timeline Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Uptime Robot: Cross-Site Request Forgery (CSRF)CVE-2025-22582 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Scott Nelle Uptime Robot uptime-robot allows Stored XSS.This issue affects Uptime Robot: from n/a through <= 0.1.3.
- Product
- Uptime Robot
- Affected
- up to 0.1.3
- What to do
- Affects up to 0.1.3. Update Uptime Robot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Arcade Ready: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22581 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bytephp Arcade Ready arcadeready allows Stored XSS.This issue affects Arcade Ready: from n/a through <= 1.1.
- Product
- Arcade Ready
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Arcade Ready to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Biltorvet Dealer Tools: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22580 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Auto IT Biltorvet Dealer Tools biltorvet-dealer-tools allows Stored XSS.This issue affects Biltorvet Dealer Tools: from n/a through <= 1.0.22.
- Product
- Biltorvet Dealer Tools
- Affected
- up to 1.0.22
- What to do
- Affects up to 1.0.22. Update Biltorvet Dealer Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025WP Header Notification: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22579 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arefly WP Header Notification wp-header-notification allows Stored XSS.This issue affects WP Header Notification: from n/a through <= 1.2.7.
- Product
- WP Header Notification
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update WP Header Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025WP Cookie: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22578 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aazztech WP Cookie wp-cookie allows Stored XSS.This issue affects WP Cookie: from n/a through <= 1.0.0.
- Product
- WP Cookie
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update WP Cookie to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Able Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22577 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Damion Armentrout Able Player wp-able-player allows DOM-Based XSS.This issue affects Able Player: from n/a through <= 1.0.
- Product
- Able Player
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Able Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025ICS Button: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22574 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cleanshooter ICS Button ics-button allows Stored XSS.This issue affects ICS Button: from n/a through <= 0.6.
- Product
- ICS Button
- Affected
- up to 0.6
- What to do
- Affects up to 0.6. Update ICS Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Icons Enricher: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22573 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in copist Icons Enricher icons-enricher allows Stored XSS.This issue affects Icons Enricher: from n/a through <= 1.0.8.
- Product
- Icons Enricher
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Icons Enricher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Legacy ePlayer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22572 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brian Legacy ePlayer sportspress-tv allows Stored XSS.This issue affects Legacy ePlayer: from n/a through <= 0.9.9.
- Product
- Legacy ePlayer
- Affected
- up to 0.9.9
- What to do
- Affects up to 0.9.9. Update Legacy ePlayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Instabot: Cross-Site Request Forgery (CSRF)CVE-2025-22571 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in instabot Instabot instabot allows Cross Site Request Forgery.This issue affects Instabot: from n/a through <= 1.10.
- Product
- Instabot
- Affected
- up to 1.10
- What to do
- Affects up to 1.10. Update Instabot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Pretty Url: Cross-Site Request Forgery (CSRF)CVE-2025-22563 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in faaiq Pretty Url pretty-url allows Cross Site Request Forgery.This issue affects Pretty Url: from n/a through <= 1.5.5.
- Product
- Pretty Url
- Affected
- up to 1.5.5
- What to do
- Affects up to 1.5.5. Update Pretty Url to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Title Experiments Free: Cross-Site Request Forgery (CSRF)CVE-2025-22562 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in kbowson Title Experiments Free wp-experiments-free allows Cross Site Request Forgery.This issue affects Title Experiments Free: from n/a through <= 9.0.4.
- Product
- Title Experiments Free
- Affected
- up to 9.0.4
- What to do
- Affects up to 9.0.4. Update Title Experiments Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Saoshyant Page Builder: Missing AuthorizationCVE-2025-22560 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in saoshyant1994 Saoshyant Page Builder saoshyant-page-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Saoshyant Page Builder: from n/a through <= 3.8.
- Product
- Saoshyant Page Builder
- Affected
- up to 3.8
- What to do
- Affects up to 3.8. Update Saoshyant Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025TubePress.NET: Cross-Site Request Forgery (CSRF)CVE-2025-22559 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in tubepress TubePress.NET tubepressnet allows Cross Site Request Forgery.This issue affects TubePress.NET: from n/a through <= 4.0.1.
- Product
- TubePress.NET
- Affected
- up to 4.0.1
- What to do
- Affects up to 4.0.1. Update TubePress.NET to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025mcjh button shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22558 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcus C. J. Hartmann mcjh button shortcode mcjh-button-shortcode allows Stored XSS.This issue affects mcjh button shortcode: from n/a through <= 1.6.4.
- Product
- mcjh button shortcode
- Affected
- up to 1.6.4
- What to do
- Affects up to 1.6.4. Update mcjh button shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025News Publisher Autopilot: Cross-Site Request Forgery (CSRF)CVE-2025-22557 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in cdowp News Publisher Autopilot wpm-news-api allows Cross Site Request Forgery.This issue affects News Publisher Autopilot: from n/a through <= 2.1.4.
- Product
- News Publisher Autopilot
- Affected
- up to 2.1.4
- What to do
- Affects up to 2.1.4. Update News Publisher Autopilot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Norse Rune Oracle: Cross-Site Request Forgery (CSRF)CVE-2025-22556 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in WP CMS Ninja Norse Rune Oracle Plugin norse-runes-oracle allows Cross Site Request Forgery.This issue affects Norse Rune Oracle Plugin: from n/a through <= 1.4.2.
- Product
- Norse Rune Oracle
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Norse Rune Oracle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Smoothness Slider Shortcode: Cross-Site Request Forgery (CSRF)CVE-2025-22555 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in njshofe Smoothness Slider Shortcode smoothness-slider-shortcode allows Cross Site Request Forgery.This issue affects Smoothness Slider Shortcode: from n/a through <= v1.2.2.
- Product
- Smoothness Slider Shortcode
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Smoothness Slider Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Video Embed Optimizer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22554 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fdfranklin06 Video Embed Optimizer video-embed-optimizer allows Stored XSS.This issue affects Video Embed Optimizer: from n/a through <= 1.0.0.
- Product
- Video Embed Optimizer
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Video Embed Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Affiliate Disclosure Statement: Cross-Site Request Forgery (CSRF)CVE-2025-22552 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in bnielsen Affiliate Disclosure Statement affiliate-disclosure-statement allows Cross Site Request Forgery.This issue affects Affiliate Disclosure Statement: from n/a through <= 0.3.
- Product
- Affiliate Disclosure Statement
- Affected
- up to 0.3
- What to do
- Affects up to 0.3. Update Affiliate Disclosure Statement to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Boot-Modal: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22551 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in albedo0 Boot-Modal boot-modal allows Stored XSS.This issue affects Boot-Modal: from n/a through <= 1.9.1.
- Product
- Boot-Modal
- Affected
- up to 1.9.1
- What to do
- Affects up to 1.9.1. Update Boot-Modal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025AddFunc Mobile Detect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22550 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joe Rhoney AddFunc Mobile Detect addfunc-mobile-detect allows Stored XSS.This issue affects AddFunc Mobile Detect: from n/a through <= 3.1.
- Product
- AddFunc Mobile Detect
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update AddFunc Mobile Detect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025WP Github: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22549 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in seinoxygen WP Github wp-github allows Stored XSS.This issue affects WP Github: from n/a through <= 1.3.3.
- Product
- WP Github
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update WP Github to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025ldap_login_password_and_role_manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22548 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in frankkoenen ldap_login_password_and_role_manager ldap-login-password-and-role-manager allows Stored XSS.This issue affects ldap_login_password_and_role_manager: from n/a through <= 1.0.12.
- Product
- ldap_login_password_and_role_manager
- Affected
- up to 1.0.12
- What to do
- Affects up to 1.0.12. Update ldap_login_password_and_role_manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025JK Html To Pdf: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22547 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jaykrishnang JK Html To Pdf jk-html-to-pdf allows Stored XSS.This issue affects JK Html To Pdf: from n/a through <= 1.0.0.
- Product
- JK Html To Pdf
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update JK Html To Pdf to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.