Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,203 results · page 10 of 25
Aug 20, 2025WP Pipes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28977 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress WP Pipes allows Reflected XSS. This issue affects WP Pipes: from n/a through 1.4.3.
- Product
- WP Pipes
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update WP Pipes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025CaptionPix: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52788 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Russell Jamieson CaptionPix captionpix allows Reflected XSS.This issue affects CaptionPix: from n/a through <= 1.8.
- Product
- CaptionPix
- Affected
- up to 1.8
- What to do
- Affects up to 1.8. Update CaptionPix to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025SMM API: Missing AuthorizationCVE-2025-52785 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in softnwords SMM API smm-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMM API: from n/a through <= 6.0.31.
- Product
- SMM API
- Affected
- up to 6.0.31
- What to do
- Affects up to 6.0.31. Update SMM API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Pinterest Automatic Pin: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-39510 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ValvePress Pinterest Automatic Pin wp-pinterest-automatic allows SQL Injection.This issue affects Pinterest Automatic Pin: from n/a through < 4.19.0.
- Product
- Pinterest Automatic Pin
- What to do
- Update Pinterest Automatic Pin to the newest version.
Aug 14, 2025WP Pipes: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-28979 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThimPress WP Pipes allows PHP Local File Inclusion. This issue affects WP Pipes: from n/a through 1.4.3.
- Product
- WP Pipes
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update WP Pipes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025The disable-right-click-powered-by-pixterme through v1.2 and pixter-image-digital-license thtough v1.0 WordPress plugins load a JavaScript file which has been cCVE-2025-8047 · WordPress plugins & themes · reported by WPScanCritical 9.8
The disable-right-click-powered-by-pixterme through v1.2 and pixter-image-digital-license thtough v1.0 WordPress plugins load a JavaScript file which has been compromised from an apparent abandoned S3 bucket. It can be used as a backdoor by those who control it, but it currently displays an alert marketing security services. Users that pay are added to allowedDomains to suppress the popup.
- What to do
- Update the plugin to the newest version.
Aug 14, 2025WP Shopify: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-7808 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Shopify WordPress plugin before 1.5.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- WP Shopify
- Fixed in
- 1.5.4
- What to do
- Update WP Shopify to 1.5.4 or newer.
Aug 2, 2025ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization: Stored Cross-Site ScriptingCVE-2025-6626 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the API URL Setting in all versions up to, and including, 3.10.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization
- Affected
- up to 3.10.3
- What to do
- Affects up to 3.10.3. Update ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 24, 2025FunnelCockpit: Reflected Cross-Site ScriptingCVE-2025-6588 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The FunnelCockpit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘error’ parameter in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrative user into performing an action such as clicking on a link.
- Product
- FunnelCockpit
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update FunnelCockpit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 22, 2025The Pixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery plugin for WordPress is vulnerabCVE-2025-7644 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Pixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via URLs in all widgets in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected
- up to 1.6.7
- What to do
- Affects up to 1.6.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 21, 2025WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests.CVE-2025-54352 · WordPress plugins & themes · reported by MITRELow 3.7
WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests. NOTE: the Supplier is not changing this behavior.
- Affected
- up to 6.8.2
- What to do
- Affects up to 6.8.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 19, 2025Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms: PHP Object InjectionCVE-2025-7696 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2.3 via deserialization of untrusted input within the verify_field_val() function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain in the Contact Form 7 plugin, which is likely to be used alongside, allows attackers to delete arbitrary files, leading to a denial of service or remote code execution when the wp-config.php file is deleted.
- Product
- Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 16, 2025Wordpress Auto Spinner: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46500 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ValvePress Wordpress Auto Spinner wp-auto-spinner allows Reflected XSS.This issue affects Wordpress Auto Spinner: from n/a through <= 3.26.0.
- Product
- Wordpress Auto Spinner
- Affected
- up to 3.26.0
- What to do
- Affects up to 3.26.0. Update Wordpress Auto Spinner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 16, 2025WP Pipes: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-28982 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThimPress WP Pipes allows SQL Injection. This issue affects WP Pipes: from n/a through 1.4.3.
- Product
- WP Pipes
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update WP Pipes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 8, 2025An authentication bypass vulnerability exists in the WordPress Pie Register plugin ≤ 3.7.1.4 that allows unauthenticated attackers to impersonate arbitrary userCVE-2025-34077 · WordPress plugins & themes · reported by VulnCheckCritical 10
An authentication bypass vulnerability exists in the WordPress Pie Register plugin ≤ 3.7.1.4 that allows unauthenticated attackers to impersonate arbitrary users by submitting a crafted POST request to the login endpoint. By setting social_site=true and manipulating the user_id_social_site parameter, an attacker can generate a valid WordPress session cookie for any user ID, including administrators. Once authenticated, the attacker may exploit plugin upload functionality to install a malicious plugin containing arbitrary PHP code, resulting in remote code execution on the underlying server.
- What to do
- Update the plugin to the newest version.
Jul 4, 2025WC Pickup Store: Missing AuthorizationCVE-2025-47634 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Keylor Mendoza WC Pickup Store wc-pickup-store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WC Pickup Store: from n/a through <= 1.8.9.
- Product
- WC Pickup Store
- Affected
- up to 1.8.9
- What to do
- Affects up to 1.8.9. Update WC Pickup Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 4, 2025Pixelating image slideshow gallery: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30979 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in gopiplus Pixelating image slideshow gallery pixelating-image-slideshow-gallery allows SQL Injection.This issue affects Pixelating image slideshow gallery: from n/a through <= 8.0.
- Product
- Pixelating image slideshow gallery
- Affected
- up to 8.0
- What to do
- Affects up to 8.0. Update Pixelating image slideshow gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 4, 2025OwnerRez API: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28957 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OwnerRez OwnerRez API ownerrez allows Stored XSS.This issue affects OwnerRez API: from n/a through <= 1.2.1.
- Product
- OwnerRez API
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update OwnerRez API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2025Image Editor by Pixo: Stored Cross-Site ScriptingCVE-2025-5588 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Image Editor by Pixo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘download’ parameter in all versions up to, and including, 2.3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Image Editor by Pixo
- Affected
- up to 2.3.6
- What to do
- Affects up to 2.3.6. Update Image Editor by Pixo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 20, 2025Zapier for: Missing AuthorizationCVE-2025-50010 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Zapier Zapier for WordPress zapier allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zapier for WordPress: from n/a through <= 1.5.2.
- Product
- Zapier for
- Affected
- up to 1.5.2
- What to do
- Affects up to 1.5.2. Update Zapier for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Oganro Travel Portal Search Widget for HotelBeds APITUDE API: Cross-Site Request Forgery (CSRF)CVE-2025-49966 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Oganro Oganro Travel Portal Search Widget for HotelBeds APITUDE API oganro-travel-portal-search-widget-for-hotelbeds-apitude-api allows Cross Site Request Forgery.This issue affects Oganro Travel Portal Search Widget for HotelBeds APITUDE API: from n/a through <= 1.0.
- Product
- Oganro Travel Portal Search Widget for HotelBeds APITUDE API
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Oganro Travel Portal Search Widget for HotelBeds APITUDE API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025PixelBeds Channel Manager and Hotel Booking Engine: Cross-Site Request Forgery (CSRF)CVE-2025-49965 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Oganro PixelBeds Channel Manager and Hotel Booking Engine pixelbeds-channel-manager-booking-engine allows Cross Site Request Forgery.This issue affects PixelBeds Channel Manager and Hotel Booking Engine: from n/a through <= 1.0.
- Product
- PixelBeds Channel Manager and Hotel Booking Engine
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update PixelBeds Channel Manager and Hotel Booking Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 18, 2025Pixel Manager for WooCommerce – Track Conversions and Analytics, Google Ads, TikTok and more: Stored Cross-Site ScriptingCVE-2025-6201 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Pixel Manager for WooCommerce – Track Conversions and Analytics, Google Ads, TikTok and more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's conversion-pixel in all versions up to, and including, 1.49.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Pixel Manager for WooCommerce – Track Conversions and Analytics, Google Ads, TikTok and more
- Affected
- up to 1.49.0
- What to do
- Affects up to 1.49.0. Update Pixel Manager for WooCommerce – Track Conversions and Analytics, Google Ads, TikTok and more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 17, 2025Pixabay Images: Arbitrary file uploadsCVE-2025-4413 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Pixabay Images plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the pixabay_upload function in all versions up to, and including, 3.4. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- Pixabay Images
- Affected
- up to 3.4
- What to do
- Affects up to 3.4. Update Pixabay Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 17, 2025Poll, Survey & Quiz Maker Plugin by Opinion Stage: Unauthorized modification of dataCVE-2025-3880 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Poll, Survey & Quiz Maker Plugin by Opinion Stage plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on several functions in all versions up to, and including, 19.9.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to change the email address for the account connection, and disconnect the plugin. Previously created content will still be displayed and functional if the account is disconnected.
- Product
- Poll, Survey & Quiz Maker Plugin by Opinion Stage
- Affected
- up to 19.9.0
- What to do
- Affects up to 19.9.0. Update Poll, Survey & Quiz Maker Plugin by Opinion Stage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 12, 2025REST API | Custom API Generator For Cross Platform And Import Export In WP: Privilege EscalationCVE-2025-5288 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The REST API | Custom API Generator For Cross Platform And Import Export In WP plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the process_handler() function in versions 1.0.0 to 2.0.3. This makes it possible for unauthenticated attackers to POST an arbitrary import_api URL, import specially crafted JSON, and thereby create a new user with full Administrator privileges.
- Product
- REST API | Custom API Generator For Cross Platform And Import Export In WP
- Affected
- 1.0.0 to 2.0.3
- What to do
- Affects 1.0.0 to 2.0.3. Update REST API | Custom API Generator For Cross Platform And Import Export In WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jun 9, 2025WP Pipes: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-48267 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThimPress WP Pipes allows Path Traversal. This issue affects WP Pipes: from n/a through 1.4.2.
- Product
- WP Pipes
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update WP Pipes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025MetalpriceAPI: Improper Control of Generation of Code ('Code Injection')CVE-2025-48140 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Control of Generation of Code ('Code Injection') vulnerability in metalpriceapi MetalpriceAPI metalpriceapi allows Code Injection.This issue affects MetalpriceAPI: from n/a through <= 1.1.4.
- Product
- MetalpriceAPI
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update MetalpriceAPI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Spice Blocks: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-48130 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in spicethemes Spice Blocks spice-blocks allows Path Traversal.This issue affects Spice Blocks: from n/a through <= 2.0.7.4.
- Product
- Spice Blocks
- Affected
- up to 2.0.7.4
- What to do
- Affects up to 2.0.7.4. Update Spice Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025PIMP - Creative MultiPurpose: Deserialization of Untrusted DataCVE-2025-31398 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in themeton PIMP - Creative MultiPurpose allows Object Injection. This issue affects PIMP - Creative MultiPurpose: from n/a through 1.7.
- Product
- PIMP - Creative MultiPurpose
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update PIMP - Creative MultiPurpose to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025External Store for Shopify: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-30999 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fahad Mahmood External Store for Shopify wp-shopify allows PHP Local File Inclusion.This issue affects External Store for Shopify: from n/a through <= 1.5.9.
- Product
- External Store for Shopify
- Affected
- up to 1.5.9
- What to do
- Affects up to 1.5.9. Update External Store for Shopify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Pinterest Verify Meta Tag: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30941 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marvie Pons Pinterest Verify Meta Tag pinterest-verify-meta-tag allows Stored XSS.This issue affects Pinterest Verify Meta Tag: from n/a through <= 1.3.
- Product
- Pinterest Verify Meta Tag
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Pinterest Verify Meta Tag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Epicwin: Cross-Site Request Forgery (CSRF)CVE-2025-28986 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Cross-Site Request Forgery (CSRF) vulnerability in Webaholicson Epicwin Plugin epicwin-subscribers allows SQL Injection.This issue affects Epicwin Plugin: from n/a through <= 1.5.
- Product
- Epicwin
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Epicwin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025bbPress API: Missing AuthorizationCVE-2025-24763 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Pascal Casier bbPress API bbp-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects bbPress API: from n/a through <= 1.0.14.
- Product
- bbPress API
- Affected
- up to 1.0.14
- What to do
- Affects up to 1.0.14. Update bbPress API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 3, 2025Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs.CVE-2025-48951 · WordPress plugins & themes · reported by GitHubCritical 9.3
Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. Versions 8.0.0-BETA3 prior to 8.3.1 contain a vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data. Applications using the Auth0-PHP SDK are affected, as are applications using the Auth0/symfony, Auth0/laravel-auth0, or Auth0/wordpress SDKs, because those SDKsrely on the Auth0-PHP SDK versions from 8.0.0-BETA3 until 8.14.0. Version 8.3.1 contains a patch for the issue.
- What to do
- Update the plugin to the newest version.
May 26, 2025MStore API – Create Native Android & iOS Apps On The Cloud: Unauthorized modification of dataCVE-2025-4683 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the create_blog function in all versions up to, and including, 4.17.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create new posts.
- Product
- MStore API – Create Native Android & iOS Apps On The Cloud
- Affected
- up to 4.17.5
- What to do
- Affects up to 4.17.5. Update MStore API – Create Native Android & iOS Apps On The Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 23, 2025Pix 4x sem juros - Pagaleve: Deserialization of Untrusted DataCVE-2025-48287 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Pagaleve Pix 4x sem juros - Pagaleve wc-pagaleve allows Object Injection.This issue affects Pix 4x sem juros - Pagaleve: from n/a through <= 1.6.9.
- Product
- Pix 4x sem juros - Pagaleve
- Affected
- up to 1.6.9
- What to do
- Affects up to 1.6.9. Update Pix 4x sem juros - Pagaleve to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025FunnelCockpit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47678 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FunnelCockpit FunnelCockpit funnelcockpit allows Reflected XSS.This issue affects FunnelCockpit: from n/a through <= 1.4.3.
- Product
- FunnelCockpit
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update FunnelCockpit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Hospital Management System: Unrestricted Upload of File with Dangerous TypeCVE-2025-47663 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in mojoomla Hospital Management System allows Upload a Web Shell to a Web Server. This issue affects Hospital Management System: from 47.0(20 through 11.
- Product
- Hospital Management System
- Affected
- up to 11
- What to do
- Affects up to 11. Update Hospital Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Hospital Management System: Incorrect Privilege AssignmentCVE-2025-47631 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in mojoomla Hospital Management System allows Privilege Escalation. This issue affects Hospital Management System: from 47.0(20 through 11.
- Product
- Hospital Management System
- Affected
- up to 11
- What to do
- Affects up to 11. Update Hospital Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Crossword Compiler Puzzles: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46493 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wordwebsoftware Crossword Compiler Puzzles crossword-compiler-puzzles allows Stored XSS.This issue affects Crossword Compiler Puzzles: from n/a through <= 14.5.
- Product
- Crossword Compiler Puzzles
- Affected
- up to 14.5
- What to do
- Affects up to 14.5. Update Crossword Compiler Puzzles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Crossword Compiler Puzzles: Unrestricted Upload of File with Dangerous TypeCVE-2025-46490 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in wordwebsoftware Crossword Compiler Puzzles crossword-compiler-puzzles allows Upload a Web Shell to a Web Server.This issue affects Crossword Compiler Puzzles: from n/a through <= 5.2.
- Product
- Crossword Compiler Puzzles
- Affected
- up to 5.2
- What to do
- Affects up to 5.2. Update Crossword Compiler Puzzles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Oxpitan: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32294 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Oxpitan oxpitan allows PHP Local File Inclusion.This issue affects Oxpitan: from n/a through <= 1.3.5.
- Product
- Oxpitan
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update Oxpitan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Pixel WordPress Form BuilderPlugin & Autoresponder: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31914 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav Pixel WordPress Form BuilderPlugin & Autoresponder pixel-formbuilder allows Blind SQL Injection.This issue affects Pixel WordPress Form BuilderPlugin & Autoresponder: from n/a through <= 1.0.2.
- Product
- Pixel WordPress Form BuilderPlugin & Autoresponder
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Pixel WordPress Form BuilderPlugin & Autoresponder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Capie: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-31060 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme Capie capie allows PHP Local File Inclusion.This issue affects Capie: from n/a through <= 1.0.40.
- Product
- Capie
- Affected
- up to 1.0.40
- What to do
- Affects up to 1.0.40. Update Capie to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Hospital Management System: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39393 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojoomla Hospital Management System hospital-management allows Reflected XSS.This issue affects Hospital Management System: from n/a through <= 47.0(20-11-2023).
- Product
- Hospital Management System
- Affected
- up to 47.0
- What to do
- Affects up to 47.0. Update Hospital Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Hospital Management System: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-39386 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla Hospital Management System hospital-management allows SQL Injection.This issue affects Hospital Management System: from n/a through <= 47.0(20-11-2023).
- Product
- Hospital Management System
- Affected
- up to 47.0
- What to do
- Affects up to 47.0. Update Hospital Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Hospital Management System: Unrestricted Upload of File with Dangerous TypeCVE-2025-39380 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in mojoomla Hospital Management System hospital-management allows Upload a Web Shell to a Web Server.This issue affects Hospital Management System: from n/a through <= 47.0(20-11-2023).
- Product
- Hospital Management System
- Affected
- up to 47.0
- What to do
- Affects up to 47.0. Update Hospital Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Hospital Management System: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-39357 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla Hospital Management System hospital-management allows SQL Injection.This issue affects Hospital Management System: from n/a through <= 47.0(20-11-2023).
- Product
- Hospital Management System
- Affected
- up to 47.0
- What to do
- Affects up to 47.0. Update Hospital Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Projectopia: Missing AuthorizationCVE-2025-48257 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Projectopia Projectopia projectopia-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Projectopia: from n/a through <= 5.1.17.
- Product
- Projectopia
- Affected
- up to 5.1.17
- What to do
- Affects up to 5.1.17. Update Projectopia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.