Vulnerability database

1,019 results · page 5 of 21

• Jan 22, 2026Ultra Portfolio: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-69180 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in themepassion Ultra Portfolio ultra-portfolio allows Blind SQL Injection.This issue affects Ultra Portfolio: from n/a through <= 6.7.

  Product

  Ultra Portfolio

  Affected

  up to 6.7

  What to do

  Affects up to 6.7. Update Ultra Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026FooEvents for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-69045 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FooEvents FooEvents for WooCommerce fooevents allows SQL Injection.This issue affects FooEvents for WooCommerce: from n/a through <= 1.20.4.

  Product

  FooEvents for WooCommerce

  Affected

  up to 1.20.4

  What to do

  Affects up to 1.20.4. Update FooEvents for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Happy Addons for Elementor: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68999 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in HappyMonster Happy Addons for Elementor happy-elementor-addons allows Blind SQL Injection.This issue affects Happy Addons for Elementor: from n/a through <= 3.20.4.

  Product

  Happy Addons for Elementor

  Affected

  up to 3.20.4

  What to do

  Affects up to 3.20.4. Update Happy Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026AppExperts: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68881 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal AppExperts appexperts allows SQL Injection.This issue affects AppExperts: from n/a through <= 1.4.5.

  Product

  AppExperts

  Affected

  up to 1.4.5

  What to do

  Affects up to 1.4.5. Update AppExperts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Paid Downloads: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68857 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ichurakov Paid Downloads paid-downloads allows Blind SQL Injection.This issue affects Paid Downloads: from n/a through <= 3.15.

  Product

  Paid Downloads

  Affected

  up to 3.15

  What to do

  Affects up to 3.15. Update Paid Downloads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026CleverReach® WP: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68034 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CleverReach® CleverReach® WP cleverreach-wp allows SQL Injection.This issue affects CleverReach® WP: from n/a through <= 1.5.21.

  Product

  CleverReach® WP

  Affected

  up to 1.5.21

  What to do

  Affects up to 1.5.21. Update CleverReach® WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Antideo Email Validator: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68017 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Antideo Antideo Email Validator antideo-email-validator allows Blind SQL Injection.This issue affects Antideo Email Validator: from n/a through <= 1.0.10.

  Product

  Antideo Email Validator

  Affected

  up to 1.0.10

  What to do

  Affects up to 1.0.10. Update Antideo Email Validator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026MailerLite – WooCommerce integration: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-67945 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MailerLite MailerLite – WooCommerce integration woo-mailerlite allows SQL Injection.This issue affects MailerLite – WooCommerce integration: from n/a through <= 3.1.2.

  Product

  MailerLite – WooCommerce integration

  Affected

  up to 3.1.2

  What to do

  Affects up to 3.1.2. Update MailerLite – WooCommerce integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026WP Lead Capturing Pages: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49055 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav WP Lead Capturing Pages wp-lead-capture allows Blind SQL Injection.This issue affects WP Lead Capturing Pages: from n/a through <= 2.5.

  Product

  WP Lead Capturing Pages

  Affected

  up to 2.5

  What to do

  Affects up to 2.5. Update WP Lead Capturing Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026WP Lead Capturing Pages: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49050 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav WP Lead Capturing Pages wp-lead-capture allows Blind SQL Injection.This issue affects WP Lead Capturing Pages: from n/a through <= 2.5.

  Product

  WP Lead Capturing Pages

  Affected

  up to 2.5

  What to do

  Affects up to 2.5. Update WP Lead Capturing Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026DZS Video Gallery: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49049 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ZoomIt DZS Video Gallery dzs-videogallery allows SQL Injection.This issue affects DZS Video Gallery: from n/a through <= 12.39.

  Product

  DZS Video Gallery

  Affected

  up to 12.39

  What to do

  Affects up to 12.39. Update DZS Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 8, 2026Automotive Listings: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-67928 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in themesuite Automotive Listings automotive allows Blind SQL Injection.This issue affects Automotive Listings: from n/a through <= 18.6.

  Product

  Automotive Listings

  Affected

  up to 18.6

  What to do

  Affects up to 18.6. Update Automotive Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 8, 2026Lobo: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-67921 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VanKarWai Lobo lobo allows Blind SQL Injection.This issue affects Lobo: from n/a through < 2.8.6.

  Product

  Lobo

  What to do

  Update Lobo to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jan 8, 2026Felan Framework: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-23993 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RiceTheme Felan Framework felan-framework allows SQL Injection.This issue affects Felan Framework: from n/a through <= 1.1.3.

  Product

  Felan Framework

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update Felan Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 8, 2026Workreap (theme's plugin): Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22728 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech Workreap (theme's plugin) workreap allows SQL Injection.This issue affects Workreap (theme's plugin): from n/a through <= 3.3.6.

  Product

  Workreap (theme's plugin)

  Affected

  up to 3.3.6

  What to do

  Affects up to 3.3.6. Update Workreap (theme's plugin) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 8, 2026WooCommerce Orders & Customers Exporter: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22713 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in vanquish WooCommerce Orders & Customers Exporter woocommerce-orders-ei allows SQL Injection.This issue affects WooCommerce Orders & Customers Exporter: from n/a through <= 5.4.

  Product

  WooCommerce Orders & Customers Exporter

  Affected

  up to 5.4

  What to do

  Affects up to 5.4. Update WooCommerce Orders & Customers Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2026WPCHURCH: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32303 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mojoomla WPCHURCH allows Blind SQL Injection.This issue affects WPCHURCH: from n/a through 2.7.0.

  Product

  WPCHURCH

  Affected

  up to 2.7.0

  What to do

  Affects up to 2.7.0. Update WPCHURCH to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 6, 2026Ninja Tables: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-69351 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjahan Jewel Ninja Tables ninja-tables allows Blind SQL Injection.This issue affects Ninja Tables: from n/a through <= 5.2.4.

  Product

  Ninja Tables

  Affected

  up to 5.2.4

  What to do

  Affects up to 5.2.4. Update Ninja Tables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 5, 2026Entrada: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-39484 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Waituk Entrada allows SQL Injection.This issue affects Entrada: from n/a through 5.7.7.

  Product

  Entrada

  Affected

  up to 5.7.7

  What to do

  Affects up to 5.7.7. Update Entrada to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 5, 2026Infility Global: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68865 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Infility Infility Global infility-global allows SQL Injection.This issue affects Infility Global: from n/a through <= 2.15.06.

  Product

  Infility Global

  Affected

  up to 2.15.06

  What to do

  Affects up to 2.15.06. Update Infility Global to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 5, 2026Premium SEO Pack: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31044 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team Premium SEO Pack allows SQL Injection.This issue affects Premium SEO Pack: from n/a through 3.3.2.

  Product

  Premium SEO Pack

  Affected

  up to 3.3.2

  What to do

  Affects up to 3.3.2. Update Premium SEO Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 5, 2026Amazon Native Shopping Recommendations: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30633 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team Amazon Native Shopping Recommendations allows SQL Injection.This issue affects Amazon Native Shopping Recommendations: from n/a through 1.3.

  Product

  Amazon Native Shopping Recommendations

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Amazon Native Shopping Recommendations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer): Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30628 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) allows SQL Injection.This issue affects Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer): from n/a through 1.2.

  Product

  Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer)

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Mediabay - WordPress Media Library Folders: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-28949 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Codedraft Mediabay - WordPress Media Library Folders allows Blind SQL Injection.This issue affects Mediabay - WordPress Media Library Folders: from n/a through 1.4.

  Product

  Mediabay - WordPress Media Library Folders

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Mediabay - WordPress Media Library Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 30, 2025Appointify: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-59129 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in appointify Appointify appointify allows Blind SQL Injection.This issue affects Appointify: from n/a through <= 1.0.8.

  Product

  Appointify

  Affected

  up to 1.0.8

  What to do

  Affects up to 1.0.8. Update Appointify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 30, 2025BWL Pro Voting Manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68990 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in xenioushk BWL Pro Voting Manager bwl-pro-voting-manager allows Blind SQL Injection.This issue affects BWL Pro Voting Manager: from n/a through <= 1.4.9.

  Product

  BWL Pro Voting Manager

  Affected

  up to 1.4.9

  What to do

  Affects up to 1.4.9. Update BWL Pro Voting Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 24, 2025Integration for Contact Form 7 HubSpot: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68590 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CRM Perks Integration for Contact Form 7 HubSpot cf7-hubspot allows Blind SQL Injection.This issue affects Integration for Contact Form 7 HubSpot: from n/a through <= 1.4.2.

  Product

  Integration for Contact Form 7 HubSpot

  Affected

  up to 1.4.2

  What to do

  Affects up to 1.4.2. Update Integration for Contact Form 7 HubSpot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 24, 2025Captivate Sync: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68570 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in captivateaudio Captivate Sync captivatesync-trade allows Blind SQL Injection.This issue affects Captivate Sync: from n/a through <= 3.2.2.

  Product

  Captivate Sync

  Affected

  up to 3.2.2

  What to do

  Affects up to 3.2.2. Update Captivate Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 24, 2025Brands for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68519 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BeRocket Brands for WooCommerce brands-for-woocommerce allows Blind SQL Injection.This issue affects Brands for WooCommerce: from n/a through <= 3.8.6.3.

  Product

  Brands for WooCommerce

  Affected

  up to 3.8.6.3

  What to do

  Affects up to 3.8.6.3. Update Brands for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 24, 2025User Feedback: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68496 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Syed Balkhi User Feedback userfeedback-lite allows Blind SQL Injection.This issue affects User Feedback: from n/a through <= 1.10.0.

  Product

  User Feedback

  Affected

  up to 1.10.0

  What to do

  Affects up to 1.10.0. Update User Feedback to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 24, 2025WPJobBoard: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-36525 · WordPress plugins & themes · reported by PatchstackHigh 8.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPJobBoard allows Blind SQL Injection.This issue affects WPJobBoard: from n/a through 5.9.0.

  Product

  WPJobBoard

  Affected

  up to 5.9.0

  What to do

  Affects up to 5.9.0. Update WPJobBoard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordvdp.patchstack.com

• Dec 23, 2025AutomatorWP: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68561 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia AutomatorWP automatorwp allows SQL Injection.This issue affects AutomatorWP: from n/a through <= 5.2.4.

  Product

  AutomatorWP

  Affected

  up to 5.2.4

  What to do

  Affects up to 5.2.4. Update AutomatorWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 23, 2025WPBulky: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68550 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VillaTheme WPBulky wpbulky-wp-bulk-edit-post-types allows Blind SQL Injection.This issue affects WPBulky: from n/a through <= 1.1.13.

  Product

  WPBulky

  Affected

  up to 1.1.13

  What to do

  Affects up to 1.1.13. Update WPBulky to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025Traveler: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-64371 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through < 3.2.6.

  Product

  Traveler

  What to do

  Update Traveler to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025tPlayer: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-60062 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mmetrodw tPlayer tplayer-html5-audio-player-with-playlist allows SQL Injection.This issue affects tPlayer: from n/a through <= 1.2.1.6.

  Product

  tPlayer

  Affected

  up to 1.2.1.6

  What to do

  Affects up to 1.2.1.6. Update tPlayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025Advance Seat Reservation Management for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-58951 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in smartcms Advance Seat Reservation Management for WooCommerce scw-seat-reservation allows SQL Injection.This issue affects Advance Seat Reservation Management for WooCommerce: from n/a through <= 3.1.

  Product

  Advance Seat Reservation Management for WooCommerce

  Affected

  up to 3.1

  What to do

  Affects up to 3.1. Update Advance Seat Reservation Management for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025PopupKit: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-14314 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Roxnor PopupKit popup-builder-block allows Blind SQL Injection.This issue affects PopupKit: from n/a through <= 2.1.5.

  Product

  PopupKit

  Affected

  up to 2.1.5

  What to do

  Affects up to 2.1.5. Update PopupKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025LBG Zoominoutslider: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68056 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup LBG Zoominoutslider lbg_zoominoutslider allows SQL Injection.This issue affects LBG Zoominoutslider: from n/a through <= 5.4.4.

  Product

  LBG Zoominoutslider

  Affected

  up to 5.4.4

  What to do

  Affects up to 5.4.4. Update LBG Zoominoutslider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025Hydra Booking: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68055 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Hydra Booking hydra-booking allows SQL Injection.This issue affects Hydra Booking: from n/a through <= 1.1.32.

  Product

  Hydra Booking

  Affected

  up to 1.1.32

  What to do

  Affects up to 1.1.32. Update Hydra Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025CountDown With Image or Video Background: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68054 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup CountDown With Image or Video Background countdown_with_background allows Blind SQL Injection.This issue affects CountDown With Image or Video Background: from n/a through <= 1.5.

  Product

  CountDown With Image or Video Background

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update CountDown With Image or Video Background to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025xPromoter: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68053 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup xPromoter top_bar_promoter allows Blind SQL Injection.This issue affects xPromoter: from n/a through <= 1.3.4.

  Product

  xPromoter

  Affected

  up to 1.3.4

  What to do

  Affects up to 1.3.4. Update xPromoter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025Newsletter: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-67999 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stefano Lissa Newsletter newsletter allows Blind SQL Injection.This issue affects Newsletter: from n/a through <= 9.0.9.

  Product

  Newsletter

  Affected

  up to 9.0.9

  What to do

  Affects up to 9.0.9. Update Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025Broken Link Checker: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-67962 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AIOSEO Plugin Team Broken Link Checker broken-link-checker-seo allows SQL Injection.This issue affects Broken Link Checker: from n/a through <= 1.2.6.

  Product

  Broken Link Checker

  Affected

  up to 1.2.6

  What to do

  Affects up to 1.2.6. Update Broken Link Checker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025All In One SEO Pack: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-67950 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Syed Balkhi All In One SEO Pack all-in-one-seo-pack allows Blind SQL Injection.This issue affects All In One SEO Pack: from n/a through <= 4.9.1.

  Product

  All In One SEO Pack

  Affected

  up to 4.9.1

  What to do

  Affects up to 4.9.1. Update All In One SEO Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2025MediaCommander – Bring Folders to Media, Posts, and Pages: Unauthorized data deletionCVE-2025-14508 · WordPress plugins & themes · reported by WordfenceMedium 6.5

  The MediaCommander – Bring Folders to Media, Posts, and Pages plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the import-csv REST API endpoint in all versions up to, and including, 2.3.1. This is due to the endpoint using `upload_files` capability check (Author level) for a destructive operation that can delete all folders. This makes it possible for authenticated attackers, with Author-level access and above, to delete all folder organization data created by Administrators and other users.

  Product

  MediaCommander – Bring Folders to Media, Posts, and Pages

  Affected

  up to 2.3.1

  What to do

  Affects up to 2.3.1. Update MediaCommander – Bring Folders to Media, Posts, and Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Dec 9, 2025Media Library Tools: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-67520 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tiny Solutions Media Library Tools media-library-tools allows SQL Injection.This issue affects Media Library Tools: from n/a through <= 1.6.15.

  Product

  Media Library Tools

  Affected

  up to 1.6.15

  What to do

  Affects up to 1.6.15. Update Media Library Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Ninja Tables: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-67519 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjahan Jewel Ninja Tables ninja-tables allows SQL Injection.This issue affects Ninja Tables: from n/a through <= 5.2.3.

  Product

  Ninja Tables

  Affected

  up to 5.2.3

  What to do

  Affects up to 5.2.3. Update Ninja Tables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Accordion Slider PRO: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-67518 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Accordion Slider PRO accordion_slider_pro allows Blind SQL Injection.This issue affects Accordion Slider PRO: from n/a through <= 1.2.

  Product

  Accordion Slider PRO

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Accordion Slider PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025ArtPlacer Widget: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-67517 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in artplacer ArtPlacer Widget artplacer-widget allows Blind SQL Injection.This issue affects ArtPlacer Widget: from n/a through <= 2.22.9.2.

  Product

  ArtPlacer Widget

  Affected

  up to 2.22.9.2

  What to do

  Affects up to 2.22.9.2. Update ArtPlacer Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Store Locator: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-67516 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Agile Logix Store Locator WordPress agile-store-locator allows Blind SQL Injection.This issue affects Store Locator WordPress: from n/a through <= 1.6.2.

  Product

  Store Locator

  Affected

  up to 1.6.2

  What to do

  Affects up to 1.6.2. Update Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.