Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
644 results · page 6 of 13
Nov 6, 2025WP Gravity Forms Keap/Infusionsoft: Deserialization of Untrusted DataCVE-2025-58636 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Keap/Infusionsoft gf-infusionsoft allows Object Injection.This issue affects WP Gravity Forms Keap/Infusionsoft: from n/a through <= 1.2.3.
- Product
- WP Gravity Forms Keap/Infusionsoft
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update WP Gravity Forms Keap/Infusionsoft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Falang multilanguage: Deserialization of Untrusted DataCVE-2025-58619 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in sbouey Falang multilanguage falang allows Object Injection.This issue affects Falang multilanguage: from n/a through <= 1.3.65.
- Product
- Falang multilanguage
- Affected
- up to 1.3.65
- What to do
- Affects up to 1.3.65. Update Falang multilanguage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025TranslatePress: Deserialization of Untrusted DataCVE-2025-58592 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Deserialization of Untrusted Data vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Object Injection.This issue affects TranslatePress: from n/a through <= 2.10.2.
- Product
- TranslatePress
- Affected
- up to 2.10.2
- What to do
- Affects up to 2.10.2. Update TranslatePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Yogi - Health Beauty & Yoga: Deserialization of Untrusted DataCVE-2025-54719 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in NooTheme Yogi - Health Beauty & Yoga noo-yogi allows Object Injection.This issue affects Yogi - Health Beauty & Yoga: from n/a through <= 2.9.2.
- Product
- Yogi - Health Beauty & Yoga
- Affected
- up to 2.9.2
- What to do
- Affects up to 2.9.2. Update Yogi - Health Beauty & Yoga to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025WeMusic: Deserialization of Untrusted DataCVE-2025-53586 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in NooTheme WeMusic noo-wemusic allows Object Injection.This issue affects WeMusic: from n/a through <= 1.9.1.
- Product
- WeMusic
- Affected
- up to 1.9.1
- What to do
- Affects up to 1.9.1. Update WeMusic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Seil: Deserialization of Untrusted DataCVE-2025-53242 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in VictorThemes Seil seil allows Object Injection.This issue affects Seil: from n/a through <= 1.7.1.
- Product
- Seil
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update Seil to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Sign-up Sheets: Deserialization of Untrusted DataCVE-2025-49393 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Fetch Designs Sign-up Sheets sign-up-sheets allows Object Injection.This issue affects Sign-up Sheets: from n/a through <= 2.3.2.
- Product
- Sign-up Sheets
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update Sign-up Sheets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Preserve Code Formatting: Deserialization of Untrusted DataCVE-2025-49386 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Scott Reilly Preserve Code Formatting preserve-code-formatting allows Object Injection.This issue affects Preserve Code Formatting: from n/a through <= 4.0.1.
- Product
- Preserve Code Formatting
- Affected
- up to 4.0.1
- What to do
- Affects up to 4.0.1. Update Preserve Code Formatting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Ajax Search Lite: Deserialization of Untrusted DataCVE-2025-48086 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Deserialization of Untrusted Data vulnerability in wpdreams Ajax Search Lite ajax-search-lite allows Object Injection.This issue affects Ajax Search Lite: from n/a through <= 4.13.3.
- Product
- Ajax Search Lite
- Affected
- up to 4.13.3
- What to do
- Affects up to 4.13.3. Update Ajax Search Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 31, 2025Polylang: Deserialization of Untrusted DataCVE-2025-64353 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Chouby Polylang polylang allows Object Injection.This issue affects Polylang: from n/a through <= 3.7.3.
- Product
- Polylang
- Affected
- up to 3.7.3
- What to do
- Affects up to 3.7.3. Update Polylang to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025WP Gravity Forms Zoho CRM and Bigin: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-62981 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Zoho CRM and Bigin gf-zoho allows Phishing.This issue affects WP Gravity Forms Zoho CRM and Bigin: from n/a through <= 1.2.8.
- Product
- WP Gravity Forms Zoho CRM and Bigin
- Affected
- up to 1.2.8
- What to do
- Affects up to 1.2.8. Update WP Gravity Forms Zoho CRM and Bigin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025JobSearch: Deserialization of Untrusted DataCVE-2025-62025 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in eyecix JobSearch wp-jobsearch.This issue affects JobSearch: from n/a through < 3.0.8.
- Product
- JobSearch
- What to do
- Update JobSearch to the newest version.
Oct 22, 2025Product Table For WooCommerce: Deserialization of Untrusted DataCVE-2025-62008 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in acowebs Product Table For WooCommerce product-table-for-woocommerce.This issue affects Product Table For WooCommerce: from n/a through <= 1.2.4.
- Product
- Product Table For WooCommerce
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Product Table For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025UNIVERSAM: Deserialization of Untrusted DataCVE-2025-60238 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in universam UNIVERSAM universam-demo allows Object Injection.This issue affects UNIVERSAM: from n/a through <= 9.04.02.
- Product
- UNIVERSAM
- Affected
- up to 9.04.02
- What to do
- Affects up to 9.04.02. Update UNIVERSAM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Single Property: Deserialization of Untrusted DataCVE-2025-60234 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in designthemes Single Property single-property allows Object Injection.This issue affects Single Property: from n/a through <= 2.8.
- Product
- Single Property
- Affected
- up to 2.8
- What to do
- Affects up to 2.8. Update Single Property to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025KBx Pro Ultimate: Deserialization of Untrusted DataCVE-2025-60232 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in quantumcloud KBx Pro Ultimate knowledgebase-helpdesk-pro allows Object Injection.This issue affects KBx Pro Ultimate: from n/a through <= 8.0.5.
- Product
- KBx Pro Ultimate
- Affected
- up to 8.0.5
- What to do
- Affects up to 8.0.5. Update KBx Pro Ultimate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Knowledge Base: Deserialization of Untrusted DataCVE-2025-60228 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in designthemes Knowledge Base kbase allows Object Injection.This issue affects Knowledge Base: from n/a through <= 2.9.
- Product
- Knowledge Base
- Affected
- up to 2.9
- What to do
- Affects up to 2.9. Update Knowledge Base to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025White Rabbit: Deserialization of Untrusted DataCVE-2025-60226 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in axiomthemes White Rabbit whiterabbit allows Object Injection.This issue affects White Rabbit: from n/a through <= 1.5.2.
- Product
- White Rabbit
- Affected
- up to 1.5.2
- What to do
- Affects up to 1.5.2. Update White Rabbit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025BugsPatrol: Deserialization of Untrusted DataCVE-2025-60225 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in AncoraThemes BugsPatrol bugspatrol allows Object Injection.This issue affects BugsPatrol: from n/a through <= 1.5.0.
- Product
- BugsPatrol
- Affected
- up to 1.5.0
- What to do
- Affects up to 1.5.0. Update BugsPatrol to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Subscribe to Download: Deserialization of Untrusted DataCVE-2025-60224 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in wpshuffle Subscribe to Download subscribe-to-download allows Object Injection.This issue affects Subscribe to Download: from n/a through <= 2.0.9.
- Product
- Subscribe to Download
- Affected
- up to 2.0.9
- What to do
- Affects up to 2.0.9. Update Subscribe to Download to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Captivate Sync: Deserialization of Untrusted DataCVE-2025-60221 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in captivateaudio Captivate Sync captivatesync-trade allows Object Injection.This issue affects Captivate Sync: from n/a through <= 3.0.3.
- Product
- Captivate Sync
- Affected
- up to 3.0.3
- What to do
- Affects up to 3.0.3. Update Captivate Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Addison: Deserialization of Untrusted DataCVE-2025-60216 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in BoldThemes Addison addison allows Object Injection.This issue affects Addison: from n/a through < 1.4.8.
- Product
- Addison
- What to do
- Update Addison to the newest version.
Oct 22, 2025Kriya: Deserialization of Untrusted DataCVE-2025-60215 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in designthemes Kriya kriya allows Object Injection.This issue affects Kriya: from n/a through <= 3.4.
- Product
- Kriya
- Affected
- up to 3.4
- What to do
- Affects up to 3.4. Update Kriya to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Goldenblatt: Deserialization of Untrusted DataCVE-2025-60214 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in BoldThemes Goldenblatt goldenblatt allows Object Injection.This issue affects Goldenblatt: from n/a through < 1.3.0.
- Product
- Goldenblatt
- What to do
- Update Goldenblatt to the newest version.
Oct 22, 2025Scape: Deserialization of Untrusted DataCVE-2025-60213 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Whitebox-Studio Scape scape allows Object Injection.This issue affects Scape: from n/a through <= 1.5.13.
- Product
- Scape
- Affected
- up to 1.5.13
- What to do
- Affects up to 1.5.13. Update Scape to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025VEDA: Deserialization of Untrusted DataCVE-2025-60212 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in designthemes VEDA veda allows Object Injection.This issue affects VEDA: from n/a through <= 4.2.
- Product
- VEDA
- Affected
- up to 4.2
- What to do
- Affects up to 4.2. Update VEDA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Everest Forms - Frontend Listing: Deserialization of Untrusted DataCVE-2025-60210 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in wpeverest Everest Forms - Frontend Listing everest-forms-frontend-listing allows Object Injection.This issue affects Everest Forms - Frontend Listing: from n/a through <= 1.0.5.
- Product
- Everest Forms - Frontend Listing
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Everest Forms - Frontend Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Connector for Gravity Forms and Google Sheets: Deserialization of Untrusted DataCVE-2025-60209 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in CRM Perks Connector for Gravity Forms and Google Sheets wp-gravity-forms-spreadsheets allows Object Injection.This issue affects Connector for Gravity Forms and Google Sheets: from n/a through <= 1.2.6.
- Product
- Connector for Gravity Forms and Google Sheets
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update Connector for Gravity Forms and Google Sheets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025WP Gravity Forms HubSpot: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-60151 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms HubSpot gf-hubspot allows Phishing.This issue affects WP Gravity Forms HubSpot: from n/a through <= 1.2.5.
- Product
- WP Gravity Forms HubSpot
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update WP Gravity Forms HubSpot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Noisa: Deserialization of Untrusted DataCVE-2025-60039 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in rascals Noisa noisa allows Object Injection.This issue affects Noisa: from n/a through <= 2.6.0.
- Product
- Noisa
- Affected
- up to 2.6.0
- What to do
- Affects up to 2.6.0. Update Noisa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025TF Woo Product Grid Addon For Elementor: Deserialization of Untrusted DataCVE-2025-59007 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in themesflat TF Woo Product Grid Addon For Elementor tf-woo-product-grid allows Object Injection.This issue affects TF Woo Product Grid Addon For Elementor: from n/a through <= 1.0.1.
- Product
- TF Woo Product Grid Addon For Elementor
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update TF Woo Product Grid Addon For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Boldermail: Deserialization of Untrusted DataCVE-2025-52740 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Hernan Villanueva Boldermail boldermail allows Object Injection.This issue affects Boldermail: from n/a through <= 2.4.0.
- Product
- Boldermail
- Affected
- up to 2.4.0
- What to do
- Affects up to 2.4.0. Update Boldermail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025WP Store Locator: Deserialization of Untrusted DataCVE-2025-52737 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Tijmen Smit WP Store Locator wp-store-locator allows Object Injection.This issue affects WP Store Locator: from n/a through <= 2.2.260.
- Product
- WP Store Locator
- Affected
- up to 2.2.260
- What to do
- Affects up to 2.2.260. Update WP Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025WooCommerce Vehicle Parts Finder: Deserialization of Untrusted DataCVE-2025-49380 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in wpinstinct WooCommerce Vehicle Parts Finder woo-vehicle-parts-finder allows Object Injection.This issue affects WooCommerce Vehicle Parts Finder: from n/a through <= 3.7.
- Product
- WooCommerce Vehicle Parts Finder
- Affected
- up to 3.7
- What to do
- Affects up to 3.7. Update WooCommerce Vehicle Parts Finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Solar Energy: Deserialization of Untrusted DataCVE-2025-32283 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in designthemes Solar Energy solar allows Object Injection.This issue affects Solar Energy: from n/a through <= 3.5.
- Product
- Solar Energy
- Affected
- up to 3.5
- What to do
- Affects up to 3.5. Update Solar Energy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Insurance: Deserialization of Untrusted DataCVE-2025-31634 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in designthemes Insurance insurance allows Object Injection.This issue affects Insurance: from n/a through <= 3.5.
- Product
- Insurance
- Affected
- up to 3.5
- What to do
- Affects up to 3.5. Update Insurance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Awesome Support: Deserialization of Untrusted DataCVE-2025-58662 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in awesomesupport Awesome Support awesome-support allows Object Injection.This issue affects Awesome Support: from n/a through <= 6.3.5.
- Product
- Awesome Support
- Affected
- up to 6.3.5
- What to do
- Affects up to 6.3.5. Update Awesome Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025WP Gravity Forms Keap/Infusionsoft: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-58006 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Keap/Infusionsoft gf-infusionsoft allows Phishing.This issue affects WP Gravity Forms Keap/Infusionsoft: from n/a through <= 1.2.6.
- Product
- WP Gravity Forms Keap/Infusionsoft
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update WP Gravity Forms Keap/Infusionsoft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025ConveyThis: Deserialization of Untrusted DataCVE-2025-57919 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in ConveyThis ConveyThis conveythis-translate allows Object Injection.This issue affects ConveyThis: from n/a through <= 269.1.
- Product
- ConveyThis
- Affected
- up to 269.1
- What to do
- Affects up to 269.1. Update ConveyThis to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025GSheets Connector: Deserialization of Untrusted DataCVE-2025-53465 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in raoinfotech GSheets Connector sheetlink allows Object Injection.This issue affects GSheets Connector: from n/a through <= 1.1.1.
- Product
- GSheets Connector
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update GSheets Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2025ThemeMove Core: Deserialization of Untrusted DataCVE-2025-53303 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in ThemeMove ThemeMove Core thememove-core allows Object Injection.This issue affects ThemeMove Core: from n/a through <= 1.4.2.
- Product
- ThemeMove Core
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update ThemeMove Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2025Constant Contact for: Deserialization of Untrusted DataCVE-2025-48101 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in webdevstudios Constant Contact for WordPress allows Object Injection. This issue affects Constant Contact for WordPress: from n/a through 4.1.1.
- Product
- Constant Contact for
- Affected
- up to 4.1.1
- What to do
- Affects up to 4.1.1. Update Constant Contact for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2025Photography: Deserialization of Untrusted DataCVE-2025-47579 · WordPress plugins & themes · reported by PatchstackCritical 9
Deserialization of Untrusted Data vulnerability in ThemeGoods Photography photography allows Object Injection.This issue affects Photography: from n/a through <= 7.7.2.
- Product
- Photography
- Affected
- up to 7.7.2
- What to do
- Affects up to 7.7.2. Update Photography to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2025GoodBarber: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-39523 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in GoodBarber GoodBarber goodbarber.This issue affects GoodBarber: from n/a through <= 1.0.26.
- Product
- GoodBarber
- Affected
- up to 1.0.26
- What to do
- Affects up to 1.0.26. Update GoodBarber to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025eDS Responsive Menu: Deserialization of Untrusted DataCVE-2025-58839 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in aThemeArt Translations eDS Responsive Menu eds-responsive-menu allows Object Injection.This issue affects eDS Responsive Menu: from n/a through <= 1.2.
- Product
- eDS Responsive Menu
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update eDS Responsive Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025Aitasi Coming Soon: Deserialization of Untrusted DataCVE-2025-58815 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Rubel Miah Aitasi Coming Soon aitasi-coming-soon allows Object Injection.This issue affects Aitasi Coming Soon: from n/a through <= 2.0.2.
- Product
- Aitasi Coming Soon
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update Aitasi Coming Soon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025LTL Freight Quotes - TQL Edition: Deserialization of Untrusted DataCVE-2025-58644 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in enituretechnology LTL Freight Quotes - TQL Edition ltl-freight-quotes-tql-edition allows Object Injection.This issue affects LTL Freight Quotes - TQL Edition: from n/a through <= 1.2.6.
- Product
- LTL Freight Quotes - TQL Edition
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update LTL Freight Quotes - TQL Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025LTL Freight Quotes – Daylight Edition: Deserialization of Untrusted DataCVE-2025-58643 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in enituretechnology LTL Freight Quotes – Daylight Edition ltl-freight-quotes-daylight-edition allows Object Injection.This issue affects LTL Freight Quotes – Daylight Edition: from n/a through <= 2.2.7.
- Product
- LTL Freight Quotes – Daylight Edition
- Affected
- up to 2.2.7
- What to do
- Affects up to 2.2.7. Update LTL Freight Quotes – Daylight Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025LTL Freight Quotes – Day & Ross Edition: Deserialization of Untrusted DataCVE-2025-58642 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in enituretechnology LTL Freight Quotes – Day & Ross Edition ltl-freight-quotes-day-ross-edition allows Object Injection.This issue affects LTL Freight Quotes – Day & Ross Edition: from n/a through <= 2.1.11.
- Product
- LTL Freight Quotes – Day & Ross Edition
- Affected
- up to 2.1.11
- What to do
- Affects up to 2.1.11. Update LTL Freight Quotes – Day & Ross Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 28, 2025WpEvently: Deserialization of Untrusted DataCVE-2025-54742 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a through <= 4.4.8.
- Product
- WpEvently
- Affected
- up to 4.4.8
- What to do
- Affects up to 4.4.8. Update WpEvently to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.