Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
579 results · page 6 of 12
Aug 20, 2025Kitring: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49426 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Dahz Kitring kitring allows PHP Local File Inclusion.This issue affects Kitring: from n/a through <= 2.8.
- Product
- Kitring
- Affected
- up to 2.8
- What to do
- Affects up to 2.8. Update Kitring to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2025Multiple FunnelKit plugins are vulnerable to Sensitive Information Exposure via the wf_get_cookie shortcode.CVE-2025-7654 · WordPress plugins & themes · reported by WordfenceHigh 8.8
Multiple FunnelKit plugins are vulnerable to Sensitive Information Exposure via the wf_get_cookie shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including authentication cookies of other site users, which may make privilege escalation possible. Please note both FunnelKit – Funnel Builder for WooCommerce Checkout AND FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce are affected by this.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 24, 2025ElementsKit Elementor Addons and Templates: Stored Cross-Site ScriptingCVE-2025-3614 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ElementsKit Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL attribute of a custom widget in all versions up to, and including, 3.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- ElementsKit Elementor Addons and Templates
- Affected
- up to 3.5.2
- What to do
- Affects up to 3.5.2. Update ElementsKit Elementor Addons and Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 24, 2025WPBookit: Arbitrary file uploadsCVE-2025-7852 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image_upload_handle() function hooked via the 'add_new_customer' route in all versions up to, and including, 1.0.6. The plugin’s image‐upload handler calls move_uploaded_file() on client‐supplied files without restricting allowed extensions or MIME types, nor sanitizing the filename. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- WPBookit
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update WPBookit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 18, 2025aapanel WP Toolkit: Privilege EscalationCVE-2025-6813 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The aapanel WP Toolkit plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization checks within the auto_login() function in versions 1.0 to 1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to bypass all role checks and gain full admin privileges.
- Product
- aapanel WP Toolkit
- Affected
- 1.0 to 1.1
- What to do
- Affects 1.0 to 1.1. Update aapanel WP Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jul 16, 2025Funnel Builder by FunnelKit: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49034 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Funnel Builder by FunnelKit funnel-builder allows SQL Injection.This issue affects Funnel Builder by FunnelKit: from n/a through <= 3.10.2.
- Product
- Funnel Builder by FunnelKit
- Affected
- up to 3.10.2
- What to do
- Affects up to 3.10.2. Update Funnel Builder by FunnelKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 16, 2025News Kit Elementor Addons: Missing AuthorizationCVE-2025-54037 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in blazethemes News Kit Elementor Addons news-kit-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects News Kit Elementor Addons: from n/a through <= 1.3.4.
- Product
- News Kit Elementor Addons
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update News Kit Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 12, 2025WPBookit: Arbitrary file uploadsCVE-2025-6058 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image_upload_handle() function hooked via the 'add_booking_type' route in all versions up to, and including, 1.0.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- WPBookit
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update WPBookit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 12, 2025WPBookit: Arbitrary file uploadsCVE-2025-6057 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the handle_image_upload() function in all versions up to, and including, 1.0.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- WPBookit
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update WPBookit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 3, 2025JKDEVKIT: Arbitrary file deletionCVE-2025-2932 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The JKDEVKIT plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'font_upload_handler' function in all versions up to, and including, 1.9.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). If WooCommerce is enabled, attackers will need Contributor-level access and above.
- Product
- JKDEVKIT
- Affected
- up to 1.9.4
- What to do
- Affects up to 1.9.4. Update JKDEVKIT to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordexample.comwordfence.com
Jul 2, 2025All-in-One Addons for Elementor – WidgetKit: Stored Cross-Site ScriptingCVE-2025-2330 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button+modal' widget in all versions up to, and including, 2.5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- All-in-One Addons for Elementor – WidgetKit
- Affected
- up to 2.5.4
- What to do
- Affects up to 2.5.4. Update All-in-One Addons for Elementor – WidgetKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 24, 2025Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit: Arbitrary file uploadsCVE-2025-6206 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'aiomatic_image_editor_ajax_submit' function in all versions up to, and including, 2.5.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. In order to exploit the vulnerability, there must be a value entered for the Stability.AI API key. The value can be arbitrary.
- Product
- Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit
- Affected
- up to 2.5.0
- What to do
- Affects up to 2.5.0. Update Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Jun 20, 2025Sitekit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50047 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly Sitekit sitekit allows Stored XSS.This issue affects Sitekit: from n/a through <= 1.9.
- Product
- Sitekit
- Affected
- up to 1.9
- What to do
- Affects up to 1.9. Update Sitekit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 19, 2025ElementsKit Elementor Addons and Templates: Stored Cross-Site ScriptingCVE-2025-4479 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ElementsKit Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin image comparison widget's before/after labels in all versions up to, and including, 3.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- ElementsKit Elementor Addons and Templates
- Affected
- up to 3.5.2
- What to do
- Affects up to 3.5.2. Update ElementsKit Elementor Addons and Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 18, 2025Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit: Unauthorized arbitrary plugin installationCVE-2025-1562 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the install_or_activate_addon_plugins() function and a weak nonce hash in all versions up to, and including, 3.5.3. This makes it possible for unauthenticated attackers to install arbitrary plugins on the site that can be leveraged to further infect a vulnerable site.
- Product
- Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit
- Affected
- up to 3.5.3
- What to do
- Affects up to 3.5.3. Update Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 17, 2025FunnelKit Automations: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-49868 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Phishing.This issue affects FunnelKit Automations: from n/a through <= 3.6.0.
- Product
- FunnelKit Automations
- Affected
- up to 3.6.0
- What to do
- Affects up to 3.6.0. Update FunnelKit Automations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 7, 2025Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders: Stored Cross-Site ScriptingCVE-2024-9994 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the eael_pricing_item_tooltip_content parameter of the Pricing Table Widget in all versions up to, and including, 6.1.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders
- Affected
- up to 6.1.12
- What to do
- Affects up to 6.1.12. Update Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 7, 2025Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders: Stored Cross-Site ScriptingCVE-2024-9993 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the eael_event_details_text parameter of Event Calendar Widget in all versions up to, and including, 6.1.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders
- Affected
- up to 6.1.12
- What to do
- Affects up to 6.1.12. Update Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 6, 2025RTMKit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49235 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rometheme RTMKit rometheme-for-elementor allows Stored XSS.This issue affects RTMKit: from n/a through <= 1.6.0.
- Product
- RTMKit
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update RTMKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025WidgetKit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49074 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Abu Huraira Bin Aman WidgetKit widgetkit-for-elementor allows Stored XSS.This issue affects WidgetKit: from n/a through <= 2.5.4.
- Product
- WidgetKit
- Affected
- up to 2.5.4
- What to do
- Affects up to 2.5.4. Update WidgetKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2025LA-Studio Element Kit for Elementor: Stored Cross-Site ScriptingCVE-2025-4944 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Compare and Google Maps widgets in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- LA-Studio Element Kit for Elementor
- Affected
- up to 1.5.2
- What to do
- Affects up to 1.5.2. Update LA-Studio Element Kit for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
May 30, 2025LA-Studio Element Kit for Elementor: Stored Cross-Site ScriptingCVE-2025-4943 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-lakit-element-link’ parameter in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- LA-Studio Element Kit for Elementor
- Affected
- up to 1.5.2
- What to do
- Affects up to 1.5.2. Update LA-Studio Element Kit for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 19, 2025AWcode Toolkit: Cross-Site Request Forgery (CSRF)CVE-2025-48238 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in awcode AWcode Toolkit awcode-toolkit allows Stored XSS.This issue affects AWcode Toolkit: from n/a through <= 1.0.18.
- Product
- AWcode Toolkit
- Affected
- up to 1.0.18
- What to do
- Affects up to 1.0.18. Update AWcode Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025Uncanny Toolkit for LearnDash: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48080 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash uncanny-learndash-toolkit allows Stored XSS.This issue affects Uncanny Toolkit for LearnDash: from n/a through <= 3.7.0.2.
- Product
- Uncanny Toolkit for LearnDash
- Affected
- up to 3.7.0.2
- What to do
- Affects up to 3.7.0.2. Update Uncanny Toolkit for LearnDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025FunnelKit: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2025-2203 · WordPress plugins & themes · reported by WPScanMedium 6.1
The FunnelKit WordPress plugin before 3.10.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- FunnelKit
- Fixed in
- 3.10.2
- What to do
- Update FunnelKit to 3.10.2 or newer.
May 15, 2025Bon Toolkit: Stored Cross-Site ScriptingCVE-2025-4589 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bon Toolkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bt-map' shortcode in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Bon Toolkit
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Bon Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 10, 2025Jeg Elementor Kit: Stored Cross-Site ScriptingCVE-2025-2944 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Video Button and Countdown Widgets in all versions up to, and including, 2.6.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Jeg Elementor Kit
- Affected
- up to 2.6.12
- What to do
- Affects up to 2.6.12. Update Jeg Elementor Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
May 8, 2025WPBookit: Privilege escalationCVE-2025-3811 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WPBookit plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.2. This is due to the plugin not properly validating a user's identity prior to updating their details like email through the edit_newdata_customer_callback() function. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
- Product
- WPBookit
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update WPBookit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 8, 2025WPBookit: Privilege escalationCVE-2025-3810 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WPBookit plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.2. This is due to the plugin not properly validating a user's identity prior to updating their details like password and email through the edit_profile_data() function. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses and passwords, including administrators, and leverage that to gain access to their account.
- Product
- WPBookit
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update WPBookit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 1, 2025OttoKit: Incorrect Privilege AssignmentCVE-2025-27007 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit: from n/a through <= 1.0.82.
- Product
- OttoKit
- Affected
- up to 1.0.82
- What to do
- Affects up to 1.0.82. Update OttoKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 1, 2025The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin for WCVE-2025-2168 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.1. This is due to missing or incorrect nonce validation on the dismiss() function. This makes it possible for unauthenticated attackers to set arbitrary user meta values to `1` which can be leveraged to lock and administrator out of their site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Affected
- up to 2.4.1
- What to do
- Affects up to 2.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 24, 2025WPMasterToolKit (WPMTK) – All in one: Directory TraversalCVE-2025-3300 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WPMasterToolKit (WPMTK) – All in one plugin plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.5.2. This makes it possible for authenticated attackers, with Administrator-level access and above, to read and modify the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- WPMasterToolKit (WPMTK) – All in one
- Affected
- up to 2.5.2
- What to do
- Affects up to 2.5.2. Update WPMasterToolKit (WPMTK) – All in one to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Apr 22, 2025GutenKit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46253 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ataur R GutenKit gutenkit-blocks-addon allows Stored XSS.This issue affects GutenKit: from n/a through <= 2.2.2.
- Product
- GutenKit
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update GutenKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 22, 2025affiliate-toolkit: Cross-Site Request Forgery (CSRF)CVE-2025-46231 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in SERVIT Software Solutions affiliate-toolkit affiliate-toolkit-starter allows Cross Site Request Forgery.This issue affects affiliate-toolkit: from n/a through <= 3.7.3.
- Product
- affiliate-toolkit
- Affected
- up to 3.7.3
- What to do
- Affects up to 3.7.3. Update affiliate-toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 18, 2025LA-Studio Element Kit for Elementor: Stored Cross-Site ScriptingCVE-2025-3106 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Table of Contents widget in all versions up to, and including, 1.4.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- LA-Studio Element Kit for Elementor
- Affected
- up to 1.4.9
- What to do
- Affects up to 1.4.9. Update LA-Studio Element Kit for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 17, 2025Ultimate Store Kit Elementor Addons: Deserialization of Untrusted DataCVE-2025-39588 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in bdthemes Ultimate Store Kit Elementor Addons ultimate-store-kit allows Object Injection.This issue affects Ultimate Store Kit Elementor Addons: from n/a through <= 2.4.0.
- Product
- Ultimate Store Kit Elementor Addons
- Affected
- up to 2.4.0
- What to do
- Affects up to 2.4.0. Update Ultimate Store Kit Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 16, 2025Travelfic Toolkit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39585 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Travelfic Toolkit travelfic-toolkit allows Stored XSS.This issue affects Travelfic Toolkit: from n/a through <= 1.2.1.
- Product
- Travelfic Toolkit
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Travelfic Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2025Uncanny Toolkit for LearnDash: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22268 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash uncanny-learndash-toolkit allows Stored XSS.This issue affects Uncanny Toolkit for LearnDash: from n/a through <= 3.7.0.1.
- Product
- Uncanny Toolkit for LearnDash
- Affected
- up to 3.7.0.1
- What to do
- Affects up to 3.7.0.1. Update Uncanny Toolkit for LearnDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025DethemeKit For Elementor: Missing AuthorizationCVE-2025-32260 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Detheme DethemeKit For Elementor dethemekit-for-elementor.This issue affects DethemeKit For Elementor: from n/a through <= 2.1.10.
- Product
- DethemeKit For Elementor
- Affected
- up to 2.1.10
- What to do
- Affects up to 2.1.10. Update DethemeKit For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025WPBookit: Missing AuthorizationCVE-2025-32254 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Iqonic Design WPBookit wpbookit allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPBookit: from n/a through <= 1.0.7.
- Product
- WPBookit
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update WPBookit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025News Kit Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32196 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in blazethemes News Kit Elementor Addons news-kit-elementor-addons allows Stored XSS.This issue affects News Kit Elementor Addons: from n/a through <= 1.4.2.
- Product
- News Kit Elementor Addons
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update News Kit Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025LA-Studio Element Kit for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32194 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Stored XSS.This issue affects LA-Studio Element Kit for Elementor: from n/a through <= 1.5.1.
- Product
- LA-Studio Element Kit for Elementor
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update LA-Studio Element Kit for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Ultimate Store Kit Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32184 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bdthemes Ultimate Store Kit Elementor Addons ultimate-store-kit allows Stored XSS.This issue affects Ultimate Store Kit Elementor Addons: from n/a through <= 2.5.0.
- Product
- Ultimate Store Kit Elementor Addons
- Affected
- up to 2.5.0
- What to do
- Affects up to 2.5.0. Update Ultimate Store Kit Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Sparkle Elementor Kit: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32157 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Jakub Glos Sparkle Elementor Kit sparkle-elementor-kit allows PHP Local File Inclusion.This issue affects Sparkle Elementor Kit: from n/a through <= 2.0.9.
- Product
- Sparkle Elementor Kit
- Affected
- up to 2.0.9
- What to do
- Affects up to 2.0.9. Update Sparkle Elementor Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2025Advanced Typekit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31622 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Utkarsh Kukreti Advanced Typekit advanced-typekit allows Stored XSS.This issue affects Advanced Typekit: from n/a through <= 1.0.1.
- Product
- Advanced Typekit
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Advanced Typekit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Bulk NoIndex & NoFollow Toolkit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31537 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in madfishdigital Bulk NoIndex & NoFollow Toolkit bulk-noindex-nofollow-toolkit-by-mad-fish allows Reflected XSS.This issue affects Bulk NoIndex & NoFollow Toolkit: from n/a through <= 2.16.
- Product
- Bulk NoIndex & NoFollow Toolkit
- Affected
- up to 2.16
- What to do
- Affects up to 2.16. Update Bulk NoIndex & NoFollow Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Agency Toolkit: Missing AuthorizationCVE-2025-31863 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in inspry Agency Toolkit agency-toolkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Agency Toolkit: from n/a through <= 1.0.24.
- Product
- Agency Toolkit
- Affected
- up to 1.0.24
- What to do
- Affects up to 1.0.24. Update Agency Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Directorist AddonsKit for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31857 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Directorist AddonsKit for Elementor addonskit-for-elementor allows Stored XSS.This issue affects Directorist AddonsKit for Elementor: from n/a through <= 1.1.6.
- Product
- Directorist AddonsKit for Elementor
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update Directorist AddonsKit for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Gutena Kit – Gutenberg Blocks and Templates: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31805 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saad Iqbal Gutena Kit – Gutenberg Blocks and Templates gutena-kit allows Stored XSS.This issue affects Gutena Kit – Gutenberg Blocks and Templates: from n/a through <= 2.0.7.
- Product
- Gutena Kit – Gutenberg Blocks and Templates
- Affected
- up to 2.0.7
- What to do
- Affects up to 2.0.7. Update Gutena Kit – Gutenberg Blocks and Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder: Stored Cross-Site ScriptingCVE-2024-12189 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom widgets in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Please note that you may need to recreate any custom widgets or reinstall the plugin to ensure the issue is adequately patched.
- Product
- WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.