Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
766 results · page 7 of 16
May 15, 2025Simple Share: Does not sanitise and escape some of its settingsCVE-2024-7556 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Share WordPress plugin through 0.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Simple Share
- Affected
- up to 0.5.3
- What to do
- Affects up to 0.5.3. Update Simple Share to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Simple Video Directory: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-6809 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Simple Video Directory WordPress plugin before 1.4.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- Simple Video Directory
- Fixed in
- 1.4.3
- What to do
- Update Simple Video Directory to 1.4.3 or newer.
May 15, 2025Simple Basic Contact Form: Does not sanitise and escape some of its settingsCVE-2024-12716 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Basic Contact Form WordPress plugin before 20250114 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Simple Basic Contact Form
- Fixed in
- 20250114
- What to do
- Update Simple Basic Contact Form to 20250114 or newer.
May 7, 2025Simple Giveaways: Cross-Site Request Forgery (CSRF)CVE-2025-47606 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Igor Benic Simple Giveaways giveasap allows Cross Site Request Forgery.This issue affects Simple Giveaways: from n/a through <= 2.49.0.
- Product
- Simple Giveaways
- Affected
- up to 2.49.0
- What to do
- Affects up to 2.49.0. Update Simple Giveaways to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Really Simple Under Construction Page: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47593 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jonas Hjalmarsson Really Simple Under Construction Page really-simple-under-construction allows Stored XSS.This issue affects Really Simple Under Construction Page: from n/a through <= 1.4.6.
- Product
- Really Simple Under Construction Page
- Affected
- up to 1.4.6
- What to do
- Affects up to 1.4.6. Update Really Simple Under Construction Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Simple calendar for Elementor: Cross-Site Request Forgery (CSRF)CVE-2025-47542 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Michael Simple calendar for Elementor simple-calendar-for-elementor allows Cross Site Request Forgery.This issue affects Simple calendar for Elementor: from n/a through <= 1.6.5.
- Product
- Simple calendar for Elementor
- Affected
- up to 1.6.5
- What to do
- Affects up to 1.6.5. Update Simple calendar for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Simple Blog Stats: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47499 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr Simple Blog Stats simple-blog-stats allows Stored XSS.This issue affects Simple Blog Stats: from n/a through <= 20250416.
- Product
- Simple Blog Stats
- Affected
- up to 20250416
- What to do
- Affects up to 20250416. Update Simple Blog Stats to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Simple File List: Missing AuthorizationCVE-2025-47450 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Mitchell Bennis Simple File List simple-file-list allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple File List: from n/a through <= 6.1.13.
- Product
- Simple File List
- Affected
- up to 6.1.13
- What to do
- Affects up to 6.1.13. Update Simple File List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 1, 2025WordPress Simple Shopping Cart: Stored Cross-Site ScriptingCVE-2025-3890 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_cart_button' shortcode in all versions up to, and including, 5.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WordPress Simple Shopping Cart
- Affected
- up to 5.1.3
- What to do
- Affects up to 5.1.3. Update WordPress Simple Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 1, 2025WordPress Simple Shopping Cart: Insecure Direct Object ReferenceCVE-2025-3889 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.3 via the 'process_payment_data' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to change the quantity of a product to a negative number, which subtracts the product cost from the total order cost. The attack will only work with Manual Checkout mode, as PayPal and Stripe will not process payments for a negative quantity.
- Product
- WordPress Simple Shopping Cart
- Affected
- up to 5.1.3
- What to do
- Affects up to 5.1.3. Update WordPress Simple Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 1, 2025WordPress Simple Shopping Cart: Insecure Direct Object ReferenceCVE-2025-3874 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.3 due to lack of randomization of a user controlled key. This makes it possible for unauthenticated attackers to access customer shopping carts and edit product links, add or delete products, and discover coupon codes.
- Product
- WordPress Simple Shopping Cart
- Affected
- up to 5.1.3
- What to do
- Affects up to 5.1.3. Update WordPress Simple Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddeveloper.wordpress.orgplugins.trac.wordpress.org
Apr 30, 2025Simple Sitemap – Create a Responsive HTML Sitemap: Missing AuthorizationCVE-2025-39413 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in David Gwyer Simple Sitemap – Create a Responsive HTML Sitemap simple-sitemap.This issue affects Simple Sitemap – Create a Responsive HTML Sitemap: from n/a through <= 3.6.0.
- Product
- Simple Sitemap – Create a Responsive HTML Sitemap
- Affected
- up to 3.6.0
- What to do
- Affects up to 3.6.0. Update Simple Sitemap – Create a Responsive HTML Sitemap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025Simple Google Photos Grid: Server-Side Request Forgery (SSRF)CVE-2025-46503 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in josheli Simple Google Photos Grid simple-google-photos-grid allows Server Side Request Forgery.This issue affects Simple Google Photos Grid: from n/a through <= 1.5.
- Product
- Simple Google Photos Grid
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Simple Google Photos Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025Seriously Simple Podcasting: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46261 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Stored XSS.This issue affects Seriously Simple Podcasting: from n/a through <= 3.9.0.
- Product
- Seriously Simple Podcasting
- Affected
- up to 3.9.0
- What to do
- Affects up to 3.9.0. Update Seriously Simple Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 23, 2025WordPress Simple Shopping Cart: Product price manipulationCVE-2025-3530 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to product price manipulation in all versions up to, and including, 5.1.2. This is due to a logic flaw involving the inconsistent use of parameters during the cart addition process. The plugin uses the parameter 'product_tmp_two' for computing a security hash against price tampering while using 'wspsc_product' to display the product, allowing an unauthenticated attacker to substitute details from a cheaper product and bypass payment for a more expensive item.
- Product
- WordPress Simple Shopping Cart
- Affected
- up to 5.1.2
- What to do
- Affects up to 5.1.2. Update WordPress Simple Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 23, 2025WordPress Simple Shopping Cart: Sensitive Information ExposureCVE-2025-3529 · WordPress plugins & themes · reported by WordfenceHigh 8.2
The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.1.2 via the 'file_url' parameter. This makes it possible for unauthenticated attackers to view potentially sensitive information and download a digital product without paying for it.
- Product
- WordPress Simple Shopping Cart
- Affected
- up to 5.1.2
- What to do
- Affects up to 5.1.2. Update WordPress Simple Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 22, 2025Simple calendar for Elementor: Cross-Site Request Forgery (CSRF)CVE-2025-46249 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Michael Simple calendar for Elementor simple-calendar-for-elementor allows Cross Site Request Forgery.This issue affects Simple calendar for Elementor: from n/a through <= 1.6.4.
- Product
- Simple calendar for Elementor
- Affected
- up to 1.6.4
- What to do
- Affects up to 1.6.4. Update Simple calendar for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 22, 2025Simple Download Counter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46240 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr Simple Download Counter simple-download-counter allows Stored XSS.This issue affects Simple Download Counter: from n/a through <= 2.2.
- Product
- Simple Download Counter
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update Simple Download Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Simple Maps: Cross-Site Request Forgery (CSRF)CVE-2025-39424 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in simplemaps Simple Maps interactive-maps allows Stored XSS.This issue affects Simple Maps: from n/a through <= 0.98.
- Product
- Simple Maps
- Affected
- up to 0.98
- What to do
- Affects up to 0.98. Update Simple Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Simple WP Events: Insertion of Sensitive Information Into Sent DataCVE-2025-32594 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Insertion of Sensitive Information Into Sent Data vulnerability in WPMinds Simple WP Events simple-wp-events allows Retrieve Embedded Sensitive Data.This issue affects Simple WP Events: from n/a through <= 1.8.17.
- Product
- Simple WP Events
- Affected
- up to 1.8.17
- What to do
- Affects up to 1.8.17. Update Simple WP Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Simple Email Subscriber: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27354 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phil88530 Simple Email Subscriber simple-email-subscriber allows Reflected XSS.This issue affects Simple Email Subscriber: from n/a through <= 2.3.
- Product
- Simple Email Subscriber
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update Simple Email Subscriber to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2025SimplyRETS Real Estate IDX: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31011 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ReichertBrothers SimplyRETS Real Estate IDX simply-rets allows Reflected XSS.This issue affects SimplyRETS Real Estate IDX: from n/a through <= 3.2.2.
- Product
- SimplyRETS Real Estate IDX
- Affected
- up to 3.2.2
- What to do
- Affects up to 3.2.2. Update SimplyRETS Real Estate IDX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2025Simple Social Media Share Buttons: Does not sanitise and escape some of its settingsCVE-2024-13610 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Social Media Share Buttons WordPress plugin before 6.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Simple Social Media Share Buttons
- Fixed in
- 6.0.0
- What to do
- Update Simple Social Media Share Buttons to 6.0.0 or newer.
Apr 11, 2025Simple WP Events: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-32509 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPMinds Simple WP Events simple-wp-events allows Path Traversal.This issue affects Simple WP Events: from n/a through <= 1.8.17.
- Product
- Simple WP Events
- Affected
- up to 1.8.17
- What to do
- Affects up to 1.8.17. Update Simple WP Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025Simple Post Meta Manager: Cross-Site Request Forgery (CSRF)CVE-2025-32556 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Sandor Kovacs Simple Post Meta Manager simple-post-meta-manager allows Reflected XSS.This issue affects Simple Post Meta Manager: from n/a through <= 1.0.9.
- Product
- Simple Post Meta Manager
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Simple Post Meta Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025Simple Spoiler: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31020 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webliberty Simple Spoiler simple-spoiler allows Stored XSS.This issue affects Simple Spoiler: from n/a through <= 1.4.
- Product
- Simple Spoiler
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Simple Spoiler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2025Simple WP Events: Arbitrary file deletionCVE-2025-2004 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Simple WP Events plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wpe_delete_file AJAX action in all versions up to, and including, 1.8.17. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). CVE-2025-32509 is a duplicate of this.
- Product
- Simple WP Events
- Affected
- up to 1.8.17
- What to do
- Affects up to 1.8.17. Update Simple WP Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 4, 2025Simple Website Logo: Missing AuthorizationCVE-2025-32258 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in InfoGiants Simple Website Logo simple-website-logo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Website Logo: from n/a through <= 1.1.
- Product
- Simple Website Logo
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Simple Website Logo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Simple WP Events: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32193 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMinds Simple WP Events simple-wp-events allows Stored XSS.This issue affects Simple WP Events: from n/a through <= 1.8.17.
- Product
- Simple WP Events
- Affected
- up to 1.8.17
- What to do
- Affects up to 1.8.17. Update Simple WP Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025SimpLy Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32176 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GalleryCreator SimpLy Gallery simply-gallery-block allows Stored XSS.This issue affects SimpLy Gallery: from n/a through <= 3.2.5.
- Product
- SimpLy Gallery
- Affected
- up to 3.2.5
- What to do
- Affects up to 3.2.5. Update SimpLy Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Simplish: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22281 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in joshix Simplish simplish allows Stored XSS.This issue affects Simplish: from n/a through <= 2.6.4.
- Product
- Simplish
- Affected
- up to 2.6.4
- What to do
- Affects up to 2.6.4. Update Simplish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website: Stored Cross-Site ScriptingCVE-2024-13898 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website
- Affected
- up to 3.0.5
- What to do
- Affects up to 3.0.5. Update Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 1, 2025Simple Map No Api: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31890 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mashi Simple Map No Api simple-map-no-api allows Stored XSS.This issue affects Simple Map No Api: from n/a through <= 1.9.
- Product
- Simple Map No Api
- Affected
- up to 1.9
- What to do
- Affects up to 1.9. Update Simple Map No Api to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Simple Sticky Add To Cart For WooCommerce: Missing AuthorizationCVE-2025-31854 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Sharaz Shahid Simple Sticky Add To Cart For WooCommerce sticky-add-to-cart-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Sticky Add To Cart For WooCommerce: from n/a through <= 1.4.9.
- Product
- Simple Sticky Add To Cart For WooCommerce
- Affected
- up to 1.4.9
- What to do
- Affects up to 1.4.9. Update Simple Sticky Add To Cart For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Simple Fixed Notice: Cross-Site Request Forgery (CSRF)CVE-2025-31840 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in digireturn Simple Fixed Notice dn-cookie-notice allows Cross Site Request Forgery.This issue affects Simple Fixed Notice: from n/a through <= 1.6.
- Product
- Simple Fixed Notice
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Simple Fixed Notice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025WP Simple HTML Sitemap: Missing AuthorizationCVE-2025-31822 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Ashish Ajani WP Simple HTML Sitemap wp-simple-html-sitemap allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Simple HTML Sitemap: from n/a through <= 3.5.
- Product
- WP Simple HTML Sitemap
- Affected
- up to 3.5
- What to do
- Affects up to 3.5. Update WP Simple HTML Sitemap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Simple Icons: Missing AuthorizationCVE-2025-31786 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Travis Simple Icons simple-icons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Icons: from n/a through <= 2.8.4.
- Product
- Simple Icons
- Affected
- up to 2.8.4
- What to do
- Affects up to 2.8.4. Update Simple Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Simple Post Expiration: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31734 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi Simple Post Expiration simple-post-expiration allows DOM-Based XSS.This issue affects Simple Post Expiration: from n/a through <= 1.0.1.
- Product
- Simple Post Expiration
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Simple Post Expiration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025Simple Contact Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31615 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in owenr88 Simple Contact Forms simple-contact-forms allows Stored XSS.This issue affects Simple Contact Forms: from n/a through <= 1.6.4.
- Product
- Simple Contact Forms
- Affected
- up to 1.6.4
- What to do
- Affects up to 1.6.4. Update Simple Contact Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025Simple-Audioplayer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31607 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in flomei Simple-Audioplayer simple-audioplayer allows Stored XSS.This issue affects Simple-Audioplayer: from n/a through <= 1.1.
- Product
- Simple-Audioplayer
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Simple-Audioplayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025Simple Owl Carousel: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31535 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PressTigers Simple Owl Carousel simple-owl-carousel allows DOM-Based XSS.This issue affects Simple Owl Carousel: from n/a through <= 1.1.1.
- Product
- Simple Owl Carousel
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Simple Owl Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025Simple:Press: Missing AuthorizationCVE-2025-31386 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in simplepress Simple:Press simplepress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple:Press: from n/a through <= 6.11.5.
- Product
- Simple:Press
- Affected
- up to 6.11.5
- What to do
- Affects up to 6.11.5. Update Simple:Press to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2025SimplyRETS Real Estate IDX: Cross-Site Request Forgery (CSRF)CVE-2025-31010 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ReichertBrothers SimplyRETS Real Estate IDX simply-rets allows Cross Site Request Forgery.This issue affects SimplyRETS Real Estate IDX: from n/a through <= 3.0.5.
- Product
- SimplyRETS Real Estate IDX
- Affected
- up to 3.0.5
- What to do
- Affects up to 3.0.5. Update SimplyRETS Real Estate IDX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2025YouTube SimpleGallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31453 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stian Andreassen YouTube SimpleGallery youtube-simplegallery allows Stored XSS.This issue affects YouTube SimpleGallery: from n/a through <= 2.0.6.
- Product
- YouTube SimpleGallery
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update YouTube SimpleGallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2025Simple Trackback Disabler: Cross-Site Request Forgery (CSRF)CVE-2025-31448 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in misteraon Simple Trackback Disabler simple-trackback-disabler allows Cross Site Request Forgery.This issue affects Simple Trackback Disabler: from n/a through <= 1.4.
- Product
- Simple Trackback Disabler
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Simple Trackback Disabler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Simple Google Calendar Outlook Events Block Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22497 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bramwaas Simple Google Calendar Outlook Events Block Widget simple-google-icalendar-widget allows Stored XSS.This issue affects Simple Google Calendar Outlook Events Block Widget: from n/a through <= 2.5.0.
- Product
- Simple Google Calendar Outlook Events Block Widget
- Affected
- up to 2.5.0
- What to do
- Affects up to 2.5.0. Update Simple Google Calendar Outlook Events Block Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Simplebooklet PDF Viewer and Embedder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30922 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in simplebooklet Simplebooklet PDF Viewer and Embedder simplebooklet allows Stored XSS.This issue affects Simplebooklet PDF Viewer and Embedder: from n/a through <= 1.1.1.
- Product
- Simplebooklet PDF Viewer and Embedder
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Simplebooklet PDF Viewer and Embedder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Simple Giveaways: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30819 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Igor Benic Simple Giveaways giveasap allows SQL Injection.This issue affects Simple Giveaways: from n/a through <= 2.48.1.
- Product
- Simple Giveaways
- Affected
- up to 2.48.1
- What to do
- Affects up to 2.48.1. Update Simple Giveaways to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 26, 2025Simple Post Series: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28934 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in chaozh Simple Post Series simple-post-series allows Reflected XSS.This issue affects Simple Post Series: from n/a through <= 2.4.4.
- Product
- Simple Post Series
- Affected
- up to 2.4.4
- What to do
- Affects up to 2.4.4. Update Simple Post Series to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 26, 2025WP Simple Slideshow: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26576 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in takumin WP Simple Slideshow wp-simple-slideshow allows Reflected XSS.This issue affects WP Simple Slideshow: from n/a through <= 1.0.
- Product
- WP Simple Slideshow
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP Simple Slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.