Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

1,094 results · page 11 of 22

Jun 6, 2025WP Gravity Forms Constant Contact: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-30954 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Constant Contact Plugin gf-constant-contact allows Phishing.This issue affects WP Gravity Forms Constant Contact Plugin: from n/a through <= 1.1.0.
Product
WP Gravity Forms Constant Contact
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update WP Gravity Forms Constant Contact to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 6, 2025WP Gravity Forms Salesforce: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-30953 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Salesforce gf-salesforce-crmperks allows Phishing.This issue affects WP Gravity Forms Salesforce: from n/a through <= 1.4.7.
Product
WP Gravity Forms Salesforce
Affected
up to 1.4.7
What to do
Affects up to 1.4.7. Update WP Gravity Forms Salesforce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 6, 2025Real Time Validation for Gravity Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48329 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daman Jeet Real Time Validation for Gravity Forms real-time-validation-for-gravity-forms allows Reflected XSS.This issue affects Real Time Validation for Gravity Forms: from n/a through <= 1.7.0.
Product
Real Time Validation for Gravity Forms
Affected
up to 1.7.0
What to do
Affects up to 1.7.0. Update Real Time Validation for Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 6, 2025Real Time Validation for Gravity Forms: Cross-Site Request Forgery (CSRF)CVE-2025-48328 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Daman Jeet Real Time Validation for Gravity Forms real-time-validation-for-gravity-forms allows Cross Site Request Forgery.This issue affects Real Time Validation for Gravity Forms: from n/a through <= 1.7.0.
Product
Real Time Validation for Gravity Forms
Affected
up to 1.7.0
What to do
Affects up to 1.7.0. Update Real Time Validation for Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 6, 2025Anti-Spam: Spam Protection | Block Spam Users, Comments, Forms: Cross-Site Request ForgeryCVE-2025-2935 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Anti-Spam: Spam Protection | Block Spam Users, Comments, Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2024.7. This is due to missing or incorrect nonce validation in the 'ss_option_maint.php' and 'ss_user_filter_list' files. This makes it possible for unauthenticated attackers to delete pending comments, and re-enable a previously blocked user via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Anti-Spam: Spam Protection | Block Spam Users, Comments, Forms
Affected
up to 2024.7
What to do
Affects up to 2024.7. Update Anti-Spam: Spam Protection | Block Spam Users, Comments, Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 5, 2025Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Stored Cross-Site ScriptingCVE-2025-5341 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id' and 'data-size’ parameters in all versions up to, and including, 1.44.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
Affected
up to 1.44.1
What to do
Affects up to 1.44.1. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 2, 2025Contact Forms by Cimatti: Cross-Site Request Forgery (CSRF)CVE-2025-49069 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in cimatti Contact Forms by Cimatti contact-forms allows Cross Site Request Forgery.This issue affects Contact Forms by Cimatti: from n/a through <= 1.9.8.
Product
Contact Forms by Cimatti
Affected
up to 1.9.8
What to do
Affects up to 1.9.8. Update Contact Forms by Cimatti to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 30, 2025Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms: Full Path DisclosureCVE-2025-4659 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.4.4. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Product
Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 23, 2025Smart Forms – when you need more than just a contact form: Stored Cross-Site ScriptingCVE-2025-5055 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Smart Forms – when you need more than just a contact form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.6.98 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Smart Forms – when you need more than just a contact form
Affected
up to 2.6.98
What to do
Affects up to 2.6.98. Update Smart Forms – when you need more than just a contact form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
May 23, 2025Infocob CRM Forms: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-47513 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in James Laforge Infocob CRM Forms infocob-crm-forms allows Path Traversal.This issue affects Infocob CRM Forms: from n/a through <= 2.4.0.
Product
Infocob CRM Forms
Affected
up to 2.4.0
What to do
Affects up to 2.4.0. Update Infocob CRM Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025Drag and Drop File Upload for Elementor Forms: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-47492 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in add-ons.org Drag and Drop File Upload for Elementor Forms drag-and-drop-file-upload-for-elementor-forms allows Path Traversal.This issue affects Drag and Drop File Upload for Elementor Forms: from n/a through <= 1.4.3.
Product
Drag and Drop File Upload for Elementor Forms
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update Drag and Drop File Upload for Elementor Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Ninja Forms: Does not sanitise and escape some of its settingsCVE-2025-2561 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Ninja Forms
Fixed in
3.10.1
What to do
Update Ninja Forms to 3.10.1 or newer.
Full record and what to do →NVD record wpscan.com
May 19, 2025Ninja Forms: Does not sanitise and escape some of its settingsCVE-2025-2560 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Ninja Forms
Fixed in
3.10.1
What to do
Update Ninja Forms to 3.10.1 or newer.
Full record and what to do →NVD record wpscan.com
May 19, 2025Ninja Forms: Does not sanitise and escape some of its settingsCVE-2025-2524 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Ninja Forms
Fixed in
3.10.1
What to do
Update Ninja Forms to 3.10.1 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Everest Forms: Does not sanitise and escape some of its settingsCVE-2024-8542 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Everest Forms WordPress plugin before 3.0.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Everest Forms
Fixed in
3.0.3.1
What to do
Update Everest Forms to 3.0.3.1 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Happyforms: Does not sanitise and escape some of its settingsCVE-2024-10054 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Happyforms WordPress plugin before 1.26.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Happyforms
Fixed in
1.26.3
What to do
Update Happyforms to 1.26.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 14, 2025Ninja Forms Webhooks: Server-Side Request ForgeryCVE-2024-13940 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Ninja Forms Webhooks plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.0.7 via the form webhook functionality. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Ninja Forms Webhooks
Affected
up to 3.0.7
What to do
Affects up to 3.0.7. Update Ninja Forms Webhooks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ninjaforms.com wordfence.com
May 9, 2025WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More: Stored Cross-Site ScriptingCVE-2025-3794 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the start_timestamp parameter in all versions up to, and including, 1.9.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More
Affected
up to 1.9.5
What to do
Affects up to 1.9.5. Update WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 8, 2025NEX-Forms – Ultimate Form Builder – Contact forms and much more: Limited Code ExecutionCVE-2025-4208 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to Limited Code Execution in all versions up to, and including, 8.9.1 via the get_table_records function. This is due to the unsanitized use of user-supplied input in call_user_func(). This makes it possible for authenticated attackers, with Custom-level access, to execute arbitrary PHP functions that meet specific constraints (static methods or global functions accepting a single array parameter).
Product
NEX-Forms – Ultimate Form Builder – Contact forms and much more
Affected
up to 8.9.1
What to do
Affects up to 8.9.1. Update NEX-Forms – Ultimate Form Builder – Contact forms and much more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 8, 2025NEX-Forms – Ultimate Form Builder – Contact forms and much more: Stored Cross-Site ScriptingCVE-2025-3468 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the clean_html and form_fields parameters in all versions up to, and including, 8.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
NEX-Forms – Ultimate Form Builder – Contact forms and much more
Affected
up to 8.9.1
What to do
Affects up to 8.9.1. Update NEX-Forms – Ultimate Form Builder – Contact forms and much more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 7, 2025Terms Popup On User Login: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47592 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Árpád Lehel Mátyus Terms Popup On User Login terms-popup-on-user-login allows Stored XSS.This issue affects Terms Popup On User Login: from n/a through <= 2.0.8.
Product
Terms Popup On User Login
Affected
up to 2.0.8
What to do
Affects up to 2.0.8. Update Terms Popup On User Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025Mollie Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47502 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nick van Wobbie Mollie Forms mollie-forms allows Stored XSS.This issue affects Mollie Forms: from n/a through <= 2.7.12.
Product
Mollie Forms
Affected
up to 2.7.12
What to do
Affects up to 2.7.12. Update Mollie Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025WP Gravity Forms Zendesk: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-47456 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Zendesk gf-zendesk allows Phishing.This issue affects WP Gravity Forms Zendesk: from n/a through <= 1.1.2.
Product
WP Gravity Forms Zendesk
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update WP Gravity Forms Zendesk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025WP Gravity Forms Dynamics CRM: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-47454 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Dynamics CRM gf-dynamics-crm allows Phishing.This issue affects WP Gravity Forms Dynamics CRM: from n/a through <= 1.1.4.
Product
WP Gravity Forms Dynamics CRM
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update WP Gravity Forms Dynamics CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 2, 2025SureForms: Does not sanitise and escape some of its Form settingsCVE-2025-3514 · WordPress plugins & themes · reported by WPScanLow 3.5
The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
SureForms
Fixed in
1.4.4
What to do
Update SureForms to 1.4.4 or newer.
Full record and what to do →NVD record wpscan.com
May 2, 2025SureForms: Does not sanitise and escape some of its Form settingsCVE-2025-3513 · WordPress plugins & themes · reported by WPScanLow 3.5
The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
SureForms
Fixed in
1.4.4
What to do
Update SureForms to 1.4.4 or newer.
Full record and what to do →NVD record wpscan.com
May 1, 2025Gravity Forms WebHooks: Server-Side Request ForgeryCVE-2024-13845 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Gravity Forms WebHooks plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.0 via the 'process_feed' method of the GF_Webhooks class This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Gravity Forms WebHooks
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update Gravity Forms WebHooks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gravityforms.com wordfence.com
Apr 30, 2025SureForms: Does not have proper authorisation checkCVE-2025-3471 · WordPress plugins & themes · reported by WPScanMedium 4.9
The SureForms WordPress plugin before 1.4.4 does not have proper authorisation check when updating its settings via the REST API, which could allow Contributor and above roles to perform such action
Product
SureForms
Fixed in
1.4.4
What to do
Update SureForms to 1.4.4 or newer.
Full record and what to do →NVD record wpscan.com
Apr 26, 2025The Create custom forms for WordPress with a smart form plugin for smart businesses: Arbitrary shortcode executionCVE-2025-2801 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The Create custom forms for WordPress with a smart form plugin for smart businesses plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.2.4. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The Create custom forms for WordPress with a smart form plugin for smart businesses
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update The Create custom forms for WordPress with a smart form plugin for smart businesses to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 24, 2025Zoho Creator Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46453 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreatorTeam Zoho Creator Forms allows Stored XSS. This issue affects Zoho Creator Forms: from n/a through 1.0.5.
Product
Zoho Creator Forms
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Zoho Creator Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 22, 2025HTML Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46236 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Link Software LLC HTML Forms html-forms allows Stored XSS.This issue affects HTML Forms: from n/a through <= 1.5.2.
Product
HTML Forms
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update HTML Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025Gravity Forms CSS Themes with Fontawesome and Placeholders: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39428 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Maros Pristas Gravity Forms CSS Themes with Fontawesome and Placeholders gravity-forms-css-themes-with-fontawesome-and-placeholder-support allows Stored XSS.This issue affects Gravity Forms CSS Themes with Fontawesome and Placeholders: from n/a through <= 8.5.
Product
Gravity Forms CSS Themes with Fontawesome and Placeholders
Affected
up to 8.5
What to do
Affects up to 8.5. Update Gravity Forms CSS Themes with Fontawesome and Placeholders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025Doppler Forms: Missing AuthorizationCVE-2025-32620 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in fromdoppler Doppler Forms doppler-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Doppler Forms: from n/a through <= 2.4.6.
Product
Doppler Forms
Affected
up to 2.4.6
What to do
Affects up to 2.4.6. Update Doppler Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Stored Cross-Site ScriptingCVE-2025-3487 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘limit’ parameter in all versions up to, and including, 1.42.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
Affected
up to 1.42.0
What to do
Affects up to 1.42.0. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 17, 2025Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Order ReplayCVE-2025-3479 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Order Replay in all versions up to, and including, 1.42.0 via the 'handle_stripe_single' function due to insufficient validation on a user controlled key. This makes it possible for unauthenticated attackers to reuse a single Stripe PaymentIntent for multiple transactions. Only the first transaction is processed via Stripe, but the plugin sends a successful email message for each transaction, which may trick an administrator into fulfilling each order.
Product
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
Affected
up to 1.42.0
What to do
Affects up to 1.42.0. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 17, 2025Fluent Forms: Stored Cross-Site ScriptingCVE-2025-3615 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Fluent Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form-submission.js script in all versions up to, and including, 6.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Fluent Forms
Affected
up to 6.0.2
What to do
Affects up to 6.0.2. Update Fluent Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 16, 2025WP Subscription Forms: Missing AuthorizationCVE-2025-39591 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WP Shuffle WP Subscription Forms wp-subscription-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Subscription Forms: from n/a through <= 1.2.3.
Product
WP Subscription Forms
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update WP Subscription Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 16, 2025Live Forms: Missing AuthorizationCVE-2025-39560 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Shahjada Live Forms liveforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Live Forms: from n/a through <= 4.8.4.
Product
Live Forms
Affected
up to 4.8.4
What to do
Affects up to 4.8.4. Update Live Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 15, 2025User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor: Stored Cross-Site ScriptingCVE-2025-2314 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.13.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The issue was partially patched in version 3.13.6 of the plugin, and fully patched in 3.13.7.
Product
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
Affected
up to 3.13.5
What to do
Affects up to 3.13.5. Update User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 11, 2025Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for: PHP Object InjectionCVE-2025-3439 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.1 via deserialization of untrusted input from the 'field_value' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Product
Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 11, 2025The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for: Arbitrary shortcode executionCVE-2025-3422 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.1.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.
Product
The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 11, 2025Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for: Reflected Cross-Site ScriptingCVE-2025-3421 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'form_id' parameter in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 10, 2025Flo Forms: Missing AuthorizationCVE-2025-32213 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in flothemesplugins Flo Forms flo-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flo Forms: from n/a through <= 1.0.43.
Product
Flo Forms
Affected
up to 1.0.43
What to do
Affects up to 1.0.43. Update Flo Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 10, 2025Piotnet Forms: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-32205 · WordPress plugins & themes · reported by PatchstackLow 2.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in piotnetdotcom Piotnet Forms piotnetforms.This issue affects Piotnet Forms: from n/a through <= 1.0.30.
Product
Piotnet Forms
Affected
up to 1.0.30
What to do
Affects up to 1.0.30. Update Piotnet Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 10, 2025Payment Forms for Paystack: Stored Cross-Site ScriptingCVE-2024-10894 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Payment Forms for Paystack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes like 'datepicker', 'textarea', and 'text' in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Payment Forms for Paystack
Affected
up to 4.0.2
What to do
Affects up to 4.0.2. Update Payment Forms for Paystack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2025WP Subscription Forms: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32692 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Shuffle WP Subscription Forms wp-subscription-forms allows PHP Local File Inclusion.This issue affects WP Subscription Forms: from n/a through <= 1.2.4.
Product
WP Subscription Forms
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update WP Subscription Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025Doppler Forms: Cross-Site Request Forgery (CSRF)CVE-2025-32667 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in fromdoppler Doppler Forms doppler-form allows Stored XSS.This issue affects Doppler Forms: from n/a through <= 2.5.1.
Product
Doppler Forms
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update Doppler Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 8, 2025Live Forms: Missing AuthorizationCVE-2025-32279 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Shahjada Live Forms liveforms.This issue affects Live Forms: from n/a through <= 4.8.5.
Product
Live Forms
Affected
up to 4.8.5
What to do
Affects up to 4.8.5. Update Live Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 4, 2025WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms: Cross-Site Request Forgery (CSRF)CVE-2025-32269 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms cf7-zendesk allows Cross Site Request Forgery.This issue affects WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms: from n/a through <= 1.1.3.
Product
WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 4, 2025Doppler Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32165 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fromdoppler Doppler Forms doppler-form allows Stored XSS.This issue affects Doppler Forms: from n/a through <= 2.5.1.
Product
Doppler Forms
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update Doppler Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.