Vulnerability database

3,631 results · page 11 of 73

• Jul 16, 2025Coupon Affiliates: Cross-Site Request Forgery (CSRF)CVE-2025-54022 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Cross-Site Request Forgery (CSRF) vulnerability in Elliot Sowersby / RelyWP Coupon Affiliates woo-coupon-usage allows Cross Site Request Forgery.This issue affects Coupon Affiliates: from n/a through <= 6.4.0.

  Product

  Coupon Affiliates

  Affected

  up to 6.4.0

  What to do

  Affects up to 6.4.0. Update Coupon Affiliates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025AntiSpam for Contact Form 7: Cross-Site Request Forgery (CSRF)CVE-2025-54020 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Erik AntiSpam for Contact Form 7 cf7-antispam allows Cross Site Request Forgery.This issue affects AntiSpam for Contact Form 7: from n/a through <= 0.6.3.

  Product

  AntiSpam for Contact Form 7

  Affected

  up to 0.6.3

  What to do

  Affects up to 0.6.3. Update AntiSpam for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025FluentSnippets: Cross-Site Request Forgery (CSRF)CVE-2025-54010 · WordPress plugins & themes · reported by PatchstackCritical 9.6

  Cross-Site Request Forgery (CSRF) vulnerability in Shahjahan Jewel FluentSnippets easy-code-manager allows Cross Site Request Forgery.This issue affects FluentSnippets: from n/a through <= 10.50.

  Product

  FluentSnippets

  Affected

  up to 10.50

  What to do

  Affects up to 10.50. Update FluentSnippets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025Import CDN-Remote Images: Cross-Site Request Forgery (CSRF)CVE-2025-48153 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Atakan Au Import CDN-Remote Images import-cdn-remote-images allows Stored XSS.This issue affects Import CDN-Remote Images: from n/a through <= 2.1.2.

  Product

  Import CDN-Remote Images

  Affected

  up to 2.1.2

  What to do

  Affects up to 2.1.2. Update Import CDN-Remote Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Trust Payments Gateway for WooCommerce (JavaScript Library): Cross-Site Request Forgery (CSRF)CVE-2025-53569 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Trust Payments Trust Payments Gateway for WooCommerce (JavaScript Library) trust-payments-gateway-3ds2 allows Cross Site Request Forgery.This issue affects Trust Payments Gateway for WooCommerce (JavaScript Library): from n/a through <= 1.3.6.

  Product

  Trust Payments Gateway for WooCommerce (JavaScript Library)

  Affected

  up to 1.3.6

  What to do

  Affects up to 1.3.6. Update Trust Payments Gateway for WooCommerce (JavaScript Library) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Radio Station: Cross-Site Request Forgery (CSRF)CVE-2025-53568 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Tony Zeoli Radio Station radio-station allows Cross Site Request Forgery.This issue affects Radio Station: from n/a through <= 2.5.12.

  Product

  Radio Station

  Affected

  up to 2.5.12

  What to do

  Affects up to 2.5.12. Update Radio Station to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Contact Form 7 reCAPTCHA: Cross-Site Request Forgery (CSRF)CVE-2025-23972 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Brian S. Reed Contact Form 7 reCAPTCHA contact-form-7-recaptcha allows Cross Site Request Forgery.This issue affects Contact Form 7 reCAPTCHA: from n/a through <= 1.2.0.

  Product

  Contact Form 7 reCAPTCHA

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update Contact Form 7 reCAPTCHA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025re.place: Cross-Site Request Forgery (CSRF)CVE-2025-53338 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in dor re.place replace allows Stored XSS.This issue affects re.place: from n/a through <= 0.2.1.

  Product

  re.place

  Affected

  up to 0.2.1

  What to do

  Affects up to 0.2.1. Update re.place to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025Track Everything: Cross-Site Request Forgery (CSRF)CVE-2025-53332 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in ethoseo Track Everything track-everything allows Stored XSS.This issue affects Track Everything: from n/a through <= 2.0.1.

  Product

  Track Everything

  Affected

  up to 2.0.1

  What to do

  Affects up to 2.0.1. Update Track Everything to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025RSS Digest: Cross-Site Request Forgery (CSRF)CVE-2025-53331 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in samcharrington RSS Digest rss-digest allows Stored XSS.This issue affects RSS Digest: from n/a through <= 1.5.

  Product

  RSS Digest

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update RSS Digest to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025Społecznościowa 6 PL 2013: Cross-Site Request Forgery (CSRF)CVE-2025-53329 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in szajenw Społecznościowa 6 PL 2013 spolecznosciowa-6-pl-2013 allows Stored XSS.This issue affects Społecznościowa 6 PL 2013: from n/a through <= 2.0.6.

  Product

  Społecznościowa 6 PL 2013

  Affected

  up to 2.0.6

  What to do

  Affects up to 2.0.6. Update Społecznościowa 6 PL 2013 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025Aioseo Multibyte Descriptions: Cross-Site Request Forgery (CSRF)CVE-2025-53327 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in rui_mashita Aioseo Multibyte Descriptions aioseo-multibyte-descriptions allows Cross Site Request Forgery.This issue affects Aioseo Multibyte Descriptions: from n/a through <= 0.0.6.

  Product

  Aioseo Multibyte Descriptions

  Affected

  up to 0.0.6

  What to do

  Affects up to 0.0.6. Update Aioseo Multibyte Descriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025WPShapere - WordPress admin: Cross-Site Request Forgery (CSRF)CVE-2025-53317 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in AcmeeDesign WPShapere - WordPress admin theme wpshapere-lite allows Stored XSS.This issue affects WPShapere - WordPress admin theme: from n/a through <= 1.4.1.

  Product

  WPShapere - WordPress admin

  Affected

  up to 1.4.1

  What to do

  Affects up to 1.4.1. Update WPShapere - WordPress admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025Relocate Upload: Cross-Site Request Forgery (CSRF)CVE-2025-53315 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in alanft Relocate Upload relocate-upload allows Stored XSS.This issue affects Relocate Upload: from n/a through <= 0.24.1.

  Product

  Relocate Upload

  Affected

  up to 0.24.1

  What to do

  Affects up to 0.24.1. Update Relocate Upload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025WP Optimizer: Cross-Site Request Forgery (CSRF)CVE-2025-53314 · WordPress plugins & themes · reported by PatchstackCritical 9.6

  Cross-Site Request Forgery (CSRF) vulnerability in sh1zen WP Optimizer wp-optimizer allows SQL Injection.This issue affects WP Optimizer: from n/a through <= 2.5.0.

  Product

  WP Optimizer

  Affected

  up to 2.5.0

  What to do

  Affects up to 2.5.0. Update WP Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025Twitch TV Embed Suite: Cross-Site Request Forgery (CSRF)CVE-2025-53313 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in plumwd Twitch TV Embed Suite twitch-tv-embed-suite allows Stored XSS.This issue affects Twitch TV Embed Suite: from n/a through <= 2.1.0.

  Product

  Twitch TV Embed Suite

  Affected

  up to 2.1.0

  What to do

  Affects up to 2.1.0. Update Twitch TV Embed Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025OnionBuzz: Cross-Site Request Forgery (CSRF)CVE-2025-53312 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Looks Awesome OnionBuzz onionbuzz-viral-quiz allows Stored XSS.This issue affects OnionBuzz: from n/a through <= 1.0.7.

  Product

  OnionBuzz

  Affected

  up to 1.0.7

  What to do

  Affects up to 1.0.7. Update OnionBuzz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025Navayan Subscribe: Cross-Site Request Forgery (CSRF)CVE-2025-53311 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Amol Nirmala Waman Navayan Subscribe navayan-subscribe allows Stored XSS.This issue affects Navayan Subscribe: from n/a through <= 1.13.

  Product

  Navayan Subscribe

  Affected

  up to 1.13

  What to do

  Affects up to 1.13. Update Navayan Subscribe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025HidePost: Cross-Site Request Forgery (CSRF)CVE-2025-53310 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Funnnny HidePost hidepost allows Reflected XSS.This issue affects HidePost: from n/a through <= 2.3.8.

  Product

  HidePost

  Affected

  up to 2.3.8

  What to do

  Affects up to 2.3.8. Update HidePost to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025Image Slider With Description: Cross-Site Request Forgery (CSRF)CVE-2025-53308 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in gopi_plus Image Slider With Description image-slider-with-description allows Stored XSS.This issue affects Image Slider With Description: from n/a through <= 9.2.

  Product

  Image Slider With Description

  Affected

  up to 9.2

  What to do

  Affects up to 9.2. Update Image Slider With Description to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025WP Forum Server: Cross-Site Request Forgery (CSRF)CVE-2025-53305 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in lucidcrew WP Forum Server forum-server allows Stored XSS.This issue affects WP Forum Server: from n/a through <= 1.8.2.

  Product

  WP Forum Server

  Affected

  up to 1.8.2

  What to do

  Affects up to 1.8.2. Update WP Forum Server to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025IS-theme-companion: Cross-Site Request Forgery (CSRF)CVE-2025-53277 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Cross-Site Request Forgery (CSRF) vulnerability in Infigo Software IS-theme-companion weblizar-companion allows Object Injection.This issue affects IS-theme-companion: from n/a through <= 1.59.

  Product

  IS-theme-companion

  Affected

  up to 1.59

  What to do

  Affects up to 1.59. Update IS-theme-companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025WP Permalink Translator: Cross-Site Request Forgery (CSRF)CVE-2025-53274 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Hossin Asaadi WP Permalink Translator wp-permalink-translator allows Stored XSS.This issue affects WP Permalink Translator: from n/a through <= 1.7.6.

  Product

  WP Permalink Translator

  Affected

  up to 1.7.6

  What to do

  Affects up to 1.7.6. Update WP Permalink Translator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025Slickstream: Cross-Site Request Forgery (CSRF)CVE-2025-53273 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Slickstream Slickstream slick-engagement allows Cross Site Request Forgery.This issue affects Slickstream: from n/a through <= 2.0.3.

  Product

  Slickstream

  Affected

  up to 2.0.3

  What to do

  Affects up to 2.0.3. Update Slickstream to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025Image Cleanup: Cross-Site Request Forgery (CSRF)CVE-2025-53272 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in opicron Image Cleanup image-cleanup allows Cross Site Request Forgery.This issue affects Image Cleanup: from n/a through <= 1.9.2.

  Product

  Image Cleanup

  Affected

  up to 1.9.2

  What to do

  Affects up to 1.9.2. Update Image Cleanup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025Additional Order Filters for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-53271 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Anton Bond Additional Order Filters for WooCommerce additional-order-filters-for-woocommerce allows Stored XSS.This issue affects Additional Order Filters for WooCommerce: from n/a through <= 1.22.

  Product

  Additional Order Filters for WooCommerce

  Affected

  up to 1.22

  What to do

  Affects up to 1.22. Update Additional Order Filters for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025WordPress CTA: Cross-Site Request Forgery (CSRF)CVE-2025-53270 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Blend Media WordPress CTA easy-sticky-sidebar allows Cross Site Request Forgery.This issue affects WordPress CTA: from n/a through <= 1.7.0.

  Product

  WordPress CTA

  Affected

  up to 1.7.0

  What to do

  Affects up to 1.7.0. Update WordPress CTA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025My Wp Brand: Cross-Site Request Forgery (CSRF)CVE-2025-53269 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in imw3 My Wp Brand my-wp-brand allows Cross Site Request Forgery.This issue affects My Wp Brand: from n/a through <= 1.1.3.

  Product

  My Wp Brand

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update My Wp Brand to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025Import external attachments: Cross-Site Request Forgery (CSRF)CVE-2025-53268 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in ryanpcmcquen Import external attachments import-external-attachments allows Cross Site Request Forgery.This issue affects Import external attachments: from n/a through <= 1.5.12.

  Product

  Import external attachments

  Affected

  up to 1.5.12

  What to do

  Affects up to 1.5.12. Update Import external attachments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025Hide Admin Bar From Front End: Cross-Site Request Forgery (CSRF)CVE-2025-53267 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Aftab Husain Hide Admin Bar From Front End hide-admin-bar-from-front-end allows Cross Site Request Forgery.This issue affects Hide Admin Bar From Front End: from n/a through <= 1.0.0.

  Product

  Hide Admin Bar From Front End

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Hide Admin Bar From Front End to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025Virusdie: Cross-Site Request Forgery (CSRF)CVE-2025-53265 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Virusdie Virusdie virusdie allows Cross Site Request Forgery.This issue affects Virusdie: from n/a through <= 1.1.3.

  Product

  Virusdie

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update Virusdie to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025ONet Regenerate Thumbnails: Cross-Site Request Forgery (CSRF)CVE-2025-53264 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Konrád Koller ONet Regenerate Thumbnails onet-regenerate-thumbnails allows Cross Site Request Forgery.This issue affects ONet Regenerate Thumbnails: from n/a through <= 1.5.

  Product

  ONet Regenerate Thumbnails

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update ONet Regenerate Thumbnails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025Address Autocomplete via Google for Gravity Forms: Cross-Site Request Forgery (CSRF)CVE-2025-53263 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in PluginsCafe Address Autocomplete via Google for Gravity Forms gf-google-address-autocomplete allows Cross Site Request Forgery.This issue affects Address Autocomplete via Google for Gravity Forms: from n/a through <= 1.3.4.

  Product

  Address Autocomplete via Google for Gravity Forms

  Affected

  up to 1.3.4

  What to do

  Affects up to 1.3.4. Update Address Autocomplete via Google for Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025Writesonic: Cross-Site Request Forgery (CSRF)CVE-2025-53262 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Writesonic Writesonic writesonic allows Cross Site Request Forgery.This issue affects Writesonic: from n/a through <= 1.0.5.

  Product

  Writesonic

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update Writesonic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025WP YouTube Live: Cross-Site Request Forgery (CSRF)CVE-2025-53261 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in macbookandrew WP YouTube Live wp-youtube-live allows Cross Site Request Forgery.This issue affects WP YouTube Live: from n/a through <= 1.10.0.

  Product

  WP YouTube Live

  Affected

  up to 1.10.0

  What to do

  Affects up to 1.10.0. Update WP YouTube Live to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025Cyrlitera: Cross-Site Request Forgery (CSRF)CVE-2025-53254 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Themeisle Cyrlitera cyrlitera allows Cross Site Request Forgery.This issue affects Cyrlitera: from n/a through <= 1.3.0.

  Product

  Cyrlitera

  Affected

  up to 1.3.0

  What to do

  Affects up to 1.3.0. Update Cyrlitera to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025WooCommerce PDF Invoice Builder: Cross-Site Request Forgery (CSRF)CVE-2025-53203 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in EDGARROJAS WooCommerce PDF Invoice Builder woo-pdf-invoice-builder allows Cross Site Request Forgery.This issue affects WooCommerce PDF Invoice Builder: from n/a through <= 1.2.148.

  Product

  WooCommerce PDF Invoice Builder

  Affected

  up to 1.2.148

  What to do

  Affects up to 1.2.148. Update WooCommerce PDF Invoice Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025Cookiebot: Cross-Site Request Forgery (CSRF)CVE-2025-53197 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in cookiebot Cookiebot cookiebot allows Cross Site Request Forgery.This issue affects Cookiebot: from n/a through <= 4.5.8.

  Product

  Cookiebot

  Affected

  up to 4.5.8

  What to do

  Affects up to 4.5.8. Update Cookiebot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025Burst Statistics: Cross-Site Request Forgery (CSRF)CVE-2025-53193 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Burst Statistics B.V. Burst Statistics burst-statistics allows Cross Site Request Forgery.This issue affects Burst Statistics: from n/a through <= 2.0.6.

  Product

  Burst Statistics

  Affected

  up to 2.0.6

  What to do

  Affects up to 2.0.6. Update Burst Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 27, 2025DarkMySite: Cross-Site Request Forgery (CSRF)CVE-2025-32281 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in DarkMySite DarkMySite darkmysite allows Cross Site Request Forgery.This issue affects DarkMySite: from n/a through <= 1.2.8.

  Product

  DarkMySite

  Affected

  up to 1.2.8

  What to do

  Affects up to 1.2.8. Update DarkMySite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Real Estate Manager: Cross-Site Request Forgery (CSRF)CVE-2025-52825 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Cross-Site Request Forgery (CSRF) vulnerability in Rameez Iqbal Real Estate Manager real-estate-manager allows Privilege Escalation.This issue affects Real Estate Manager: from n/a through <= 7.3.

  Product

  Real Estate Manager

  Affected

  up to 7.3

  What to do

  Affects up to 7.3. Update Real Estate Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025WP Front User Submit / Front Editor: Cross-Site Request Forgery (CSRF)CVE-2025-52795 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in aharonyan WP Front User Submit / Front Editor front-editor allows Cross Site Request Forgery.This issue affects WP Front User Submit / Front Editor: from n/a through <= 5.0.6.

  Product

  WP Front User Submit / Front Editor

  Affected

  up to 5.0.6

  What to do

  Affects up to 5.0.6. Update WP Front User Submit / Front Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Creative Contact Form: Cross-Site Request Forgery (CSRF)CVE-2025-52794 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Creative-Solutions Creative Contact Form sexy-contact-form allows Stored XSS.This issue affects Creative Contact Form: from n/a through <= 1.0.0.

  Product

  Creative Contact Form

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Creative Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Esselink.nu Settings: Cross-Site Request Forgery (CSRF)CVE-2025-52793 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Esselink.nu Esselink.nu Settings esselinknu-settings allows Reflected XSS.This issue affects Esselink.nu Settings: from n/a through <= 4.5.

  Product

  Esselink.nu Settings

  Affected

  up to 4.5

  What to do

  Affects up to 4.5. Update Esselink.nu Settings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025WP User Stylesheet Switcher: Cross-Site Request Forgery (CSRF)CVE-2025-52792 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in vgstef WP User Stylesheet Switcher wp-user-stylesheet-switcher allows Stored XSS.This issue affects WP User Stylesheet Switcher: from n/a through <= v2.2.0.

  Product

  WP User Stylesheet Switcher

  Affected

  up to 2.2.0

  What to do

  Affects up to 2.2.0. Update WP User Stylesheet Switcher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Knowledge Base – Knowledge Base Maker: Cross-Site Request Forgery (CSRF)CVE-2025-52791 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in devfelixmoira Knowledge Base – Knowledge Base Maker knowledge-base-maker allows Stored XSS.This issue affects Knowledge Base – Knowledge Base Maker: from n/a through <= 1.1.8.

  Product

  Knowledge Base – Knowledge Base Maker

  Affected

  up to 1.1.8

  What to do

  Affects up to 1.1.8. Update Knowledge Base – Knowledge Base Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025WP-DownloadCounter: Cross-Site Request Forgery (CSRF)CVE-2025-52790 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in r-win WP-DownloadCounter wp-downloadcounter allows Stored XSS.This issue affects WP-DownloadCounter: from n/a through <= 1.01.

  Product

  WP-DownloadCounter

  Affected

  up to 1.01

  What to do

  Affects up to 1.01. Update WP-DownloadCounter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Lewe ChordPress: Cross-Site Request Forgery (CSRF)CVE-2025-52789 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in George Lewe Lewe ChordPress chordpress allows Stored XSS.This issue affects Lewe ChordPress: from n/a through <= 4.0.1.

  Product

  Lewe ChordPress

  Affected

  up to 4.0.1

  What to do

  Affects up to 4.0.1. Update Lewe ChordPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Bluff Post: Cross-Site Request Forgery (CSRF)CVE-2025-52784 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in hideoguchi Bluff Post bluff-post allows Stored XSS.This issue affects Bluff Post: from n/a through <= 1.1.1.

  Product

  Bluff Post

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Bluff Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Change Cart button Colors WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-52783 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in themelocation Change Cart button Colors WooCommerce wc-style allows Stored XSS.This issue affects Change Cart button Colors WooCommerce: from n/a through <= 1.0.

  Product

  Change Cart button Colors WooCommerce

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Change Cart button Colors WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.