Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
644 results · page 8 of 13
Jun 6, 2025Photography: Deserialization of Untrusted DataCVE-2025-47584 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Deserialization of Untrusted Data vulnerability in ThemeGoods Photography.This issue affects Photography: from n/a through 7.5.2.
- Product
- Photography
- Affected
- up to 7.5.2
- What to do
- Affects up to 7.5.2. Update Photography to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025WP Posts Carousel: Deserialization of Untrusted DataCVE-2025-39358 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in teastudio.pl WP Posts Carousel wp-posts-carousel allows Object Injection.This issue affects WP Posts Carousel: from n/a through <= 1.3.12.
- Product
- WP Posts Carousel
- Affected
- up to 1.3.12
- What to do
- Affects up to 1.3.12. Update WP Posts Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 29, 2025Course Builder: Deserialization of Untrusted DataCVE-2025-48336 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThimPress Course Builder course-builder allows Object Injection.This issue affects Course Builder: from n/a through < 3.6.6.
- Product
- Course Builder
- What to do
- Update Course Builder to the newest version.
May 23, 2025Kids Planet: Deserialization of Untrusted DataCVE-2025-48289 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in AncoraThemes Kids Planet kidsplanet allows Object Injection.This issue affects Kids Planet: from n/a through <= 2.2.14.
- Product
- Kids Planet
- Affected
- up to 2.2.14
- What to do
- Affects up to 2.2.14. Update Kids Planet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Pix 4x sem juros - Pagaleve: Deserialization of Untrusted DataCVE-2025-48287 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Pagaleve Pix 4x sem juros - Pagaleve wc-pagaleve allows Object Injection.This issue affects Pix 4x sem juros - Pagaleve: from n/a through <= 1.6.9.
- Product
- Pix 4x sem juros - Pagaleve
- Affected
- up to 1.6.9
- What to do
- Affects up to 1.6.9. Update Pix 4x sem juros - Pagaleve to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025WC Affiliate: Deserialization of Untrusted DataCVE-2025-47660 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Codexpert, Inc WC Affiliate wc-affiliate allows Object Injection.This issue affects WC Affiliate: from n/a through <= 2.16.
- Product
- WC Affiliate
- Affected
- up to 2.16
- What to do
- Affects up to 2.16. Update WC Affiliate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025ZoomSounds: Deserialization of Untrusted DataCVE-2025-47568 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ZoomIt ZoomSounds dzs-zoomsounds allows Object Injection.This issue affects ZoomSounds: from n/a through <= 6.91.
- Product
- ZoomSounds
- Affected
- up to 6.91
- What to do
- Affects up to 6.91. Update ZoomSounds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025CoinPayments.net Payment Gateway for WooCommerce: Deserialization of Untrusted DataCVE-2025-47532 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in CoinPayments CoinPayments.net Payment Gateway for WooCommerce coinpayments-payment-gateway-for-woocommerce allows Object Injection.This issue affects CoinPayments.net Payment Gateway for WooCommerce: from n/a through <= 1.0.17.
- Product
- CoinPayments.net Payment Gateway for WooCommerce
- Affected
- up to 1.0.17
- What to do
- Affects up to 1.0.17. Update CoinPayments.net Payment Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025WPFunnels: Deserialization of Untrusted DataCVE-2025-47530 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in WPFunnels WPFunnels wpfunnels allows Object Injection.This issue affects WPFunnels: from n/a through <= 3.5.18.
- Product
- WPFunnels
- Affected
- up to 3.5.18
- What to do
- Affects up to 3.5.18. Update WPFunnels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Goodlayers Hotel: Deserialization of Untrusted DataCVE-2025-39503 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in GoodLayers Goodlayers Hotel gdlr-hotel allows Object Injection.This issue affects Goodlayers Hotel: from n/a through <= 3.1.4.
- Product
- Goodlayers Hotel
- Affected
- up to 3.1.4
- What to do
- Affects up to 3.1.4. Update Goodlayers Hotel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Goodlayers Hostel: Deserialization of Untrusted DataCVE-2025-39500 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in GoodLayers Goodlayers Hostel gdlr-hostel allows Object Injection.This issue affects Goodlayers Hostel: from n/a through <= 3.1.2.
- Product
- Goodlayers Hostel
- Affected
- up to 3.1.2
- What to do
- Affects up to 3.1.2. Update Goodlayers Hostel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Medicare: Deserialization of Untrusted DataCVE-2025-39499 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in BoldThemes Medicare medicare allows Object Injection.This issue affects Medicare: from n/a through <= 2.1.0.
- Product
- Medicare
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update Medicare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Avantage: Deserialization of Untrusted DataCVE-2025-39495 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in BoldThemes Avantage avantage allows Object Injection.This issue affects Avantage: from n/a through <= 2.4.9.
- Product
- Avantage
- Affected
- up to 2.4.9
- What to do
- Affects up to 2.4.9. Update Avantage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Grand Tour: Deserialization of Untrusted DataCVE-2025-39485 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Tour grandtour allows Object Injection.This issue affects Grand Tour: from n/a through <= 5.6.
- Product
- Grand Tour
- Affected
- up to 5.6
- What to do
- Affects up to 5.6. Update Grand Tour to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Car Dealer: Deserialization of Untrusted DataCVE-2025-39480 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeMakers Car Dealer cardealer allows Object Injection.This issue affects Car Dealer: from n/a through < 1.6.8.
- Product
- Car Dealer
- What to do
- Update Car Dealer to the newest version.
May 23, 2025Finance Consultant: Deserialization of Untrusted DataCVE-2025-32293 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in designthemes Finance Consultant finance allows Object Injection.This issue affects Finance Consultant: from n/a through <= 2.8.
- Product
- Finance Consultant
- Affected
- up to 2.8
- What to do
- Affects up to 2.8. Update Finance Consultant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Jarvis – Night Club, Concert, Festival: Deserialization of Untrusted DataCVE-2025-32292 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in AncoraThemes Jarvis – Night Club, Concert, Festival WordPress jarvis allows Object Injection.This issue affects Jarvis – Night Club, Concert, Festival WordPress: from n/a through <= 1.8.11.
- Product
- Jarvis – Night Club, Concert, Festival
- Affected
- up to 1.8.11
- What to do
- Affects up to 1.8.11. Update Jarvis – Night Club, Concert, Festival to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Pet World: Deserialization of Untrusted DataCVE-2025-32284 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in designthemes Pet World petsworld allows Object Injection.This issue affects Pet World: from n/a through <= 2.8.
- Product
- Pet World
- Affected
- up to 2.8
- What to do
- Affects up to 2.8. Update Pet World to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Acerola: Deserialization of Untrusted DataCVE-2025-31927 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in themeton Acerola allows Object Injection. This issue affects Acerola: from n/a through 1.6.5.
- Product
- Acerola
- Affected
- up to 1.6.5
- What to do
- Affects up to 1.6.5. Update Acerola to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Crafts & Arts: Deserialization of Untrusted DataCVE-2025-31924 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in designthemes Crafts & Arts crafts-and-arts allows Object Injection.This issue affects Crafts & Arts: from n/a through <= 2.5.
- Product
- Crafts & Arts
- Affected
- up to 2.5
- What to do
- Affects up to 2.5. Update Crafts & Arts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Fish House: Deserialization of Untrusted DataCVE-2025-31631 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in AncoraThemes Fish House fish-house allows Object Injection.This issue affects Fish House: from n/a through <= 1.2.7.
- Product
- Fish House
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update Fish House to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025The Business: Deserialization of Untrusted DataCVE-2025-31430 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in themeton The Business allows Object Injection. This issue affects The Business: from n/a through 1.6.1.
- Product
- The Business
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update The Business to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Umberto: Deserialization of Untrusted DataCVE-2025-31423 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in AncoraThemes Umberto umberto allows Object Injection.This issue affects Umberto: from n/a through <= 1.2.8.
- Product
- Umberto
- Affected
- up to 1.2.8
- What to do
- Affects up to 1.2.8. Update Umberto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025HotStar – Multi-Purpose Business: Deserialization of Untrusted DataCVE-2025-31069 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in themeton HotStar – Multi-Purpose Business Theme allows Object Injection. This issue affects HotStar – Multi-Purpose Business Theme: from n/a through 1.4.
- Product
- HotStar – Multi-Purpose Business
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update HotStar – Multi-Purpose Business to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Dash: Deserialization of Untrusted DataCVE-2025-31049 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in themeton Dash allows Object Injection. This issue affects Dash: from n/a through 1.3.
- Product
- Dash
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Dash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Foodbakery Sticky Cart: Deserialization of Untrusted DataCVE-2025-39356 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Chimpstudio Foodbakery Sticky Cart foodbakery-sticky-cart allows Object Injection.This issue affects Foodbakery Sticky Cart: from n/a through <= 3.2.
- Product
- Foodbakery Sticky Cart
- Affected
- up to 3.2
- What to do
- Affects up to 3.2. Update Foodbakery Sticky Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Grand Conference: Deserialization of Untrusted DataCVE-2025-39354 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Conference grandconference allows Object Injection.This issue affects Grand Conference: from n/a through <= 5.3.
- Product
- Grand Conference
- Affected
- up to 5.3
- What to do
- Affects up to 5.3. Update Grand Conference to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025CiyaShop: Deserialization of Untrusted DataCVE-2025-39349 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Potenzaglobalsolutions CiyaShop ciyashop allows Object Injection.This issue affects CiyaShop: from n/a through <= 4.18.0.
- Product
- CiyaShop
- Affected
- up to 4.18.0
- What to do
- Affects up to 4.18.0. Update CiyaShop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Grand Restaurant: Deserialization of Untrusted DataCVE-2025-39348 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Object Injection.This issue affects Grand Restaurant: from n/a through <= 7.0.
- Product
- Grand Restaurant
- Affected
- up to 7.0
- What to do
- Affects up to 7.0. Update Grand Restaurant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Altair: Deserialization of Untrusted DataCVE-2025-32928 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeGoods Altair altair allows Object Injection.This issue affects Altair: from n/a through <= 5.2.2.
- Product
- Altair
- Affected
- up to 5.2.2
- What to do
- Affects up to 5.2.2. Update Altair to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025FoodBakery: Deserialization of Untrusted DataCVE-2025-32927 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Chimpstudio FoodBakery wp-foodbakery allows Object Injection.This issue affects FoodBakery: from n/a through <= 3.3.
- Product
- FoodBakery
- Affected
- up to 3.3
- What to do
- Affects up to 3.3. Update FoodBakery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025WordPress Events Calendar Registration & Tickets: Deserialization of Untrusted DataCVE-2025-47581 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in elbisnero WordPress Events Calendar Registration & Tickets wpeventplus allows Object Injection.This issue affects WordPress Events Calendar Registration & Tickets: from n/a through <= 2.6.0.
- Product
- WordPress Events Calendar Registration & Tickets
- Affected
- up to 2.6.0
- What to do
- Affects up to 2.6.0. Update WordPress Events Calendar Registration & Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Smart Sections Theme Builder - WPBakery Page Builder Addon: Deserialization of Untrusted DataCVE-2025-39410 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in themegusta Smart Sections Theme Builder - WPBakery Page Builder Addon.This issue affects Smart Sections Theme Builder - WPBakery Page Builder Addon: from n/a through 1.7.8.
- Product
- Smart Sections Theme Builder - WPBakery Page Builder Addon
- Affected
- up to 1.7.8
- What to do
- Affects up to 1.7.8. Update Smart Sections Theme Builder - WPBakery Page Builder Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025WPBot Pro Wordpress Chatbot: Deserialization of Untrusted DataCVE-2025-47582 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in QuantumCloud WPBot Pro Wordpress Chatbot allows Object Injection.This issue affects WPBot Pro Wordpress Chatbot: from n/a through 12.7.0.
- Product
- WPBot Pro Wordpress Chatbot
- Affected
- up to 12.7.0
- What to do
- Affects up to 12.7.0. Update WPBot Pro Wordpress Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025WP Tabs: Deserialization of Untrusted DataCVE-2025-48134 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in ShapedPlugin LLC WP Tabs wp-expand-tabs-free allows Object Injection.This issue affects WP Tabs: from n/a through <= 2.2.12.
- Product
- WP Tabs
- Affected
- up to 2.2.12
- What to do
- Affects up to 2.2.12. Update WP Tabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025This User Activity Tracking and Log WordPress plugin before 4.1.4 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to maniCVE-2024-0970 · WordPress plugins & themes · reported by WPScanMedium 5.3
This User Activity Tracking and Log WordPress plugin before 4.1.4 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value.
- Fixed in
- 4.1.4
- What to do
- Update the plugin to 4.1.4 or newer.
May 7, 2025WP Maintenance: Deserialization of Untrusted DataCVE-2025-47683 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Florent Maillefaud WP Maintenance wp-maintenance allows Object Injection.This issue affects WP Maintenance: from n/a through <= 6.1.9.7.
- Product
- WP Maintenance
- Affected
- up to 6.1.9.7
- What to do
- Affects up to 6.1.9.7. Update WP Maintenance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Integrations of Zoho CRM with Elementor form: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-47644 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in formsintegrations Integrations of Zoho CRM with Elementor form integrations-of-zoho-crm-with-elementor-form allows Phishing.This issue affects Integrations of Zoho CRM with Elementor form: from n/a through <= 1.0.8.
- Product
- Integrations of Zoho CRM with Elementor form
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Integrations of Zoho CRM with Elementor form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025WP-CRM System: Deserialization of Untrusted DataCVE-2025-47629 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Mario Peshev WP-CRM System wp-crm-system allows Object Injection.This issue affects WP-CRM System: from n/a through <= 3.4.5.
- Product
- WP-CRM System
- Affected
- up to 3.4.5
- What to do
- Affects up to 3.4.5. Update WP-CRM System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025WP Gravity Forms Zendesk: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-47456 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Zendesk gf-zendesk allows Phishing.This issue affects WP Gravity Forms Zendesk: from n/a through <= 1.1.2.
- Product
- WP Gravity Forms Zendesk
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update WP Gravity Forms Zendesk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Integration for WooCommerce and Salesforce: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-47455 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for WooCommerce and Salesforce woo-salesforce-plugin-crm-perks allows Phishing.This issue affects Integration for WooCommerce and Salesforce: from n/a through <= 1.7.5.
- Product
- Integration for WooCommerce and Salesforce
- Affected
- up to 1.7.5
- What to do
- Affects up to 1.7.5. Update Integration for WooCommerce and Salesforce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025WP Gravity Forms Dynamics CRM: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-47454 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Dynamics CRM gf-dynamics-crm allows Phishing.This issue affects WP Gravity Forms Dynamics CRM: from n/a through <= 1.1.4.
- Product
- WP Gravity Forms Dynamics CRM
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update WP Gravity Forms Dynamics CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025Flickr Shortcode Importer: Deserialization of Untrusted DataCVE-2025-46481 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Michael Cannon Flickr Shortcode Importer flickr-shortcode-importer allows Object Injection.This issue affects Flickr Shortcode Importer: from n/a through <= 2.2.3.
- Product
- Flickr Shortcode Importer
- Affected
- up to 2.2.3
- What to do
- Affects up to 2.2.3. Update Flickr Shortcode Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025Social Counter: Deserialization of Untrusted DataCVE-2025-46473 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Prisna Social Counter social-counter allows Object Injection.This issue affects Social Counter: from n/a through <= 2.0.5.
- Product
- Social Counter
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update Social Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025Sassy Social Share: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-39404 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Heateor Support Sassy Social Share sassy-social-share allows Phishing.This issue affects Sassy Social Share: from n/a through <= 3.3.73.
- Product
- Sassy Social Share
- Affected
- up to 3.3.73
- What to do
- Affects up to 3.3.73. Update Sassy Social Share to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Ultimate Store Kit Elementor Addons: Deserialization of Untrusted DataCVE-2025-39588 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in bdthemes Ultimate Store Kit Elementor Addons ultimate-store-kit allows Object Injection.This issue affects Ultimate Store Kit Elementor Addons: from n/a through <= 2.4.0.
- Product
- Ultimate Store Kit Elementor Addons
- Affected
- up to 2.4.0
- What to do
- Affects up to 2.4.0. Update Ultimate Store Kit Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025FluentBoards: Deserialization of Untrusted DataCVE-2025-39551 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Mahmudul Hasan Arif FluentBoards fluent-boards allows Object Injection.This issue affects FluentBoards: from n/a through <= 1.47.
- Product
- FluentBoards
- Affected
- up to 1.47
- What to do
- Affects up to 1.47. Update FluentBoards to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025FluentCommunity: Deserialization of Untrusted DataCVE-2025-39550 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Shahjahan Jewel FluentCommunity fluent-community allows Object Injection.This issue affects FluentCommunity: from n/a through <= 1.2.15.
- Product
- FluentCommunity
- Affected
- up to 1.2.15
- What to do
- Affects up to 1.2.15. Update FluentCommunity to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Rating by BestWebSoft: Deserialization of Untrusted DataCVE-2025-39527 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in bestweblayout Rating by BestWebSoft rating-bws allows Object Injection.This issue affects Rating by BestWebSoft: from n/a through <= 1.7.
- Product
- Rating by BestWebSoft
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Rating by BestWebSoft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Team Members: Deserialization of Untrusted DataCVE-2025-32686 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in WPSpeedo Team Members wps-team allows Object Injection.This issue affects Team Members: from n/a through <= 3.4.4.
- Product
- Team Members
- Affected
- up to 3.4.4
- What to do
- Affects up to 3.4.4. Update Team Members to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.