Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,219 results · page 11 of 85
Dec 31, 2025iNext Woo Pincode Checker: Cross-Site Request Forgery (CSRF)CVE-2025-62084 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Imdad Next Web iNext Woo Pincode Checker inext-woo-pincode-checker allows Cross Site Request Forgery.This issue affects iNext Woo Pincode Checker: from n/a through <= 2.3.1.
- Product
- iNext Woo Pincode Checker
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update iNext Woo Pincode Checker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Live Shopping & Shoppable Videos For WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-62080 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Channelize.io Team Live Shopping & Shoppable Videos For WooCommerce live-shopping-video-streams allows Cross Site Request Forgery.This issue affects Live Shopping & Shoppable Videos For WooCommerce: from n/a through <= 2.2.0.
- Product
- Live Shopping & Shoppable Videos For WooCommerce
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update Live Shopping & Shoppable Videos For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Appointify: Cross-Site Request Forgery (CSRF)CVE-2025-59130 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in appointify Appointify appointify allows Cross Site Request Forgery.This issue affects Appointify: from n/a through <= 1.0.8.
- Product
- Appointify
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Appointify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Contact Form Widget: Cross-Site Request Forgery (CSRF)CVE-2025-62134 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in A WP Life Contact Form Widget new-contact-form-widget allows Cross Site Request Forgery.This issue affects Contact Form Widget: from n/a through <= 1.5.1.
- Product
- Contact Form Widget
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update Contact Form Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025OpenHook: Cross-Site Request Forgery (CSRF)CVE-2025-62120 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Rick Beckman OpenHook thesis-openhook allows Cross Site Request Forgery.This issue affects OpenHook: from n/a through <= 4.3.1.
- Product
- OpenHook
- Affected
- up to 4.3.1
- What to do
- Affects up to 4.3.1. Update OpenHook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025EasyIndex: Cross-Site Request Forgery (CSRF)CVE-2025-62117 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Jayce53 EasyIndex easyindex allows Cross Site Request Forgery.This issue affects EasyIndex: from n/a through <= 1.1.1704.
- Product
- EasyIndex
- Affected
- up to 1.1.1704
- What to do
- Affects up to 1.1.1704. Update EasyIndex to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Everest Backup: Cross-Site Request Forgery (CSRF)CVE-2025-62992 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in everestthemes Everest Backup everest-backup allows Path Traversal.This issue affects Everest Backup: from n/a through <= 2.3.11.
- Product
- Everest Backup
- Affected
- up to 2.3.11
- What to do
- Affects up to 2.3.11. Update Everest Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Zoho ZeptoMail: Cross-Site Request Forgery (CSRF)CVE-2025-49028 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Zoho Mail Zoho ZeptoMail transmail allows Stored XSS.This issue affects Zoho ZeptoMail: from n/a through <= 3.3.1.
- Product
- Zoho ZeptoMail
- Affected
- up to 3.3.1
- What to do
- Affects up to 3.3.1. Update Zoho ZeptoMail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Custom Post Status: Cross-Site Request Forgery (CSRF)CVE-2025-68885 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in page-carbajal Custom Post Status custom-post-status allows Stored XSS.This issue affects Custom Post Status: from n/a through <= 1.1.0.
- Product
- Custom Post Status
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Custom Post Status to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Recent Posts From Each Category: Cross-Site Request Forgery (CSRF)CVE-2025-49354 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Mindstien Technologies Recent Posts From Each Category recent-posts-from-each-category allows Stored XSS.This issue affects Recent Posts From Each Category: from n/a through <= 1.4.
- Product
- Recent Posts From Each Category
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Recent Posts From Each Category to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Noindex by Path: Cross-Site Request Forgery (CSRF)CVE-2025-49353 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Marcin Kijak Noindex by Path noindex-by-path allows Stored XSS.This issue affects Noindex by Path: from n/a through <= 1.0.
- Product
- Noindex by Path
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Noindex by Path to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025WP-EasyArchives: Cross-Site Request Forgery (CSRF)CVE-2025-49345 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in mg12 WP-EasyArchives wp-easyarchives allows Stored XSS.This issue affects WP-EasyArchives: from n/a through <= 3.1.2.
- Product
- WP-EasyArchives
- Affected
- up to 3.1.2
- What to do
- Affects up to 3.1.2. Update WP-EasyArchives to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025SensitiveTagCloud: Cross-Site Request Forgery (CSRF)CVE-2025-49344 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in reneade SensitiveTagCloud sensitive-tag-cloud allows Stored XSS.This issue affects SensitiveTagCloud: from n/a through <= 1.4.1.
- Product
- SensitiveTagCloud
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update SensitiveTagCloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Social Profilr: Cross-Site Request Forgery (CSRF)CVE-2025-49343 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in socialprofilr Social Profilr social-profilr-display-social-network-profile allows Stored XSS.This issue affects Social Profilr: from n/a through <= 1.0.
- Product
- Social Profilr
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Social Profilr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Custom Style: Cross-Site Request Forgery (CSRF)CVE-2025-49342 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in merzedes Custom Style custom-style allows Stored XSS.This issue affects Custom Style: from n/a through <= 1.0.
- Product
- Custom Style
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Custom Style to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Behance Portfolio Manager: Cross-Site Request Forgery (CSRF)CVE-2025-59137 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in eleopard Behance Portfolio Manager portfolio-manager-powered-by-behance allows Stored XSS.This issue affects Behance Portfolio Manager: from n/a through <= 1.7.5.
- Product
- Behance Portfolio Manager
- Affected
- up to 1.7.5
- What to do
- Affects up to 1.7.5. Update Behance Portfolio Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Simple Archive Generator: Cross-Site Request Forgery (CSRF)CVE-2025-49346 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in peterwsterling Simple Archive Generator simple-archive-generator allows Stored XSS.This issue affects Simple Archive Generator: from n/a through <= 5.2.
- Product
- Simple Archive Generator
- Affected
- up to 5.2
- What to do
- Affects up to 5.2. Update Simple Archive Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025WP-CalDav2ICS: Cross-Site Request Forgery (CSRF)CVE-2025-59131 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in hoernerfranz WP-CalDav2ICS wp-caldav2ics allows Stored XSS.This issue affects WP-CalDav2ICS: from n/a through <= 1.3.4.
- Product
- WP-CalDav2ICS
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update WP-CalDav2ICS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Import into Easy Property Listings: Cross-Site Request Forgery (CSRF)CVE-2025-62112 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Merv Barrett Import into Easy Property Listings easy-property-listings-xml-csv-import allows Cross Site Request Forgery.This issue affects Import into Easy Property Listings: from n/a through <= 2.2.1.
- Product
- Import into Easy Property Listings
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update Import into Easy Property Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025WING WordPress Migrator: Cross-Site Request Forgery (CSRF)CVE-2025-52835 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in ConoHa by GMO WING WordPress Migrator wing-migrator allows Upload a Web Shell to a Web Server.This issue affects WING WordPress Migrator: from n/a through <= 1.2.0.
- Product
- WING WordPress Migrator
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update WING WordPress Migrator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Popup box: Cross-Site Request Forgery (CSRF)CVE-2025-69021 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Popup box ays-popup-box allows Cross Site Request Forgery.This issue affects Popup box: from n/a through <= 6.0.7.
- Product
- Popup box
- Affected
- up to 6.0.7
- What to do
- Affects up to 6.0.7. Update Popup box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Youzify: Server-Side Request Forgery (SSRF)CVE-2025-69014 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in Youzify Youzify youzify allows Server Side Request Forgery.This issue affects Youzify: from n/a through <= 1.3.7.
- Product
- Youzify
- Affected
- up to 1.3.7
- What to do
- Affects up to 1.3.7. Update Youzify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Heateor Social Login: Cross-Site Request Forgery (CSRF)CVE-2025-68998 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Heateor Support Heateor Social Login heateor-social-login allows Cross Site Request Forgery.This issue affects Heateor Social Login: from n/a through <= 1.1.39.
- Product
- Heateor Social Login
- Affected
- up to 1.1.39
- What to do
- Affects up to 1.1.39. Update Heateor Social Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 29, 2025WordPress Image shrinker: Server-Side Request Forgery (SSRF)CVE-2025-68893 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in HETWORKS WordPress Image shrinker wp-image-shrinker allows Server Side Request Forgery.This issue affects WordPress Image shrinker: from n/a through <= 1.1.0.
- Product
- WordPress Image shrinker
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update WordPress Image shrinker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Five Star Restaurant Reservations: Cross-Site Request Forgery (CSRF)CVE-2025-68601 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Rustaurius Five Star Restaurant Reservations restaurant-reservations allows Cross Site Request Forgery.This issue affects Five Star Restaurant Reservations: from n/a through <= 2.7.8.
- Product
- Five Star Restaurant Reservations
- Affected
- up to 2.7.8
- What to do
- Affects up to 2.7.8. Update Five Star Restaurant Reservations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Link Library: Server-Side Request Forgery (SSRF)CVE-2025-68600 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in Yannick Lefebvre Link Library link-library allows Server Side Request Forgery.This issue affects Link Library: from n/a through <= 7.8.7.
- Product
- Link Library
- Affected
- up to 7.8.7
- What to do
- Affects up to 7.8.7. Update Link Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Vimeotheque: Cross-Site Request Forgery (CSRF)CVE-2025-68584 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Constantin Boiangiu Vimeotheque codeflavors-vimeo-video-post-lite allows Cross Site Request Forgery.This issue affects Vimeotheque: from n/a through <= 2.3.5.2.
- Product
- Vimeotheque
- Affected
- up to 2.3.5.2
- What to do
- Affects up to 2.3.5.2. Update Vimeotheque to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Fast User Switching: Cross-Site Request Forgery (CSRF)CVE-2025-68583 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Tikweb Management Fast User Switching fast-user-switching allows Cross Site Request Forgery.This issue affects Fast User Switching: from n/a through <= 1.4.10.
- Product
- Fast User Switching
- Affected
- up to 1.4.10
- What to do
- Affects up to 1.4.10. Update Fast User Switching to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Advanced Classifieds & Directory Pro: Cross-Site Request Forgery (CSRF)CVE-2025-68580 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in pluginsware Advanced Classifieds & Directory Pro advanced-classifieds-and-directory-pro allows Cross Site Request Forgery.This issue affects Advanced Classifieds & Directory Pro: from n/a through <= 3.2.9.
- Product
- Advanced Classifieds & Directory Pro
- Affected
- up to 3.2.9
- What to do
- Affects up to 3.2.9. Update Advanced Classifieds & Directory Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Simple Keyword to Link: Cross-Site Request Forgery (CSRF)CVE-2025-68573 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Alessandro Piconi Simple Keyword to Link simple-keyword-to-link allows Cross Site Request Forgery.This issue affects Simple Keyword to Link: from n/a through <= 1.5.
- Product
- Simple Keyword to Link
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Simple Keyword to Link to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025My auctions allegro: Cross-Site Request Forgery (CSRF)CVE-2025-68567 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Cross Site Request Forgery.This issue affects My auctions allegro: from n/a through <= 3.6.33.
- Product
- My auctions allegro
- Affected
- up to 3.6.33
- What to do
- Affects up to 3.6.33. Update My auctions allegro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025WP Email Capture: Cross-Site Request Forgery (CSRF)CVE-2025-68529 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Rhys Wynne WP Email Capture wp-email-capture allows Cross Site Request Forgery.This issue affects WP Email Capture: from n/a through <= 3.12.5.
- Product
- WP Email Capture
- Affected
- up to 3.12.5
- What to do
- Affects up to 3.12.5. Update WP Email Capture to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Prime Slider – Addons For Elementor: Server-Side Request Forgery (SSRF)CVE-2025-68500 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in bdthemes Prime Slider – Addons For Elementor bdthemes-prime-slider-lite allows Server Side Request Forgery.This issue affects Prime Slider – Addons For Elementor: from n/a through <= 4.0.10.
- Product
- Prime Slider – Addons For Elementor
- Affected
- up to 4.0.10
- What to do
- Affects up to 4.0.10. Update Prime Slider – Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Trade Runner: Cross-Site Request Forgery (CSRF)CVE-2025-67625 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in tmtraderunner Trade Runner traderunner allows Cross Site Request Forgery.This issue affects Trade Runner: from n/a through <= 3.14.
- Product
- Trade Runner
- Affected
- up to 3.14
- What to do
- Affects up to 3.14. Update Trade Runner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 20256Storage Rentals: Server-Side Request Forgery (SSRF)CVE-2025-67623 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Server-Side Request Forgery (SSRF) vulnerability in 6Storage 6Storage Rentals 6storage-rentals allows Server Side Request Forgery.This issue affects 6Storage Rentals: from n/a through <= 2.22.0.
- Product
- 6Storage Rentals
- Affected
- up to 2.22.0
- What to do
- Affects up to 2.22.0. Update 6Storage Rentals to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Evergreen Post Tweeter: Cross-Site Request Forgery (CSRF)CVE-2025-67622 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in titopandub Evergreen Post Tweeter evergreen-post-tweeter allows Stored XSS.This issue affects Evergreen Post Tweeter: from n/a through <= 1.8.9.
- Product
- Evergreen Post Tweeter
- Affected
- up to 1.8.9
- What to do
- Affects up to 1.8.9. Update Evergreen Post Tweeter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 23, 2025Premium Addons for Elementor: Cross-Site Request ForgeryCVE-2025-14163 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Premium Addons for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.11.53. This is due to missing nonce validation in the 'insert_inner_template' function. This makes it possible for unauthenticated attackers to create arbitrary Elementor templates via a forged request granted they can trick a site administrator or other user with the edit_posts capability into performing an action such as clicking on a link.
- Product
- Premium Addons for Elementor
- Affected
- up to 4.11.53
- What to do
- Affects up to 4.11.53. Update Premium Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 22, 2025Custom 404 Pro: Cross-Site Request Forgery (CSRF)CVE-2025-62880 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Kunal Custom 404 Pro custom-404-pro allows Cross Site Request Forgery.This issue affects Custom 404 Pro: from n/a through <= 3.12.0.
- Product
- Custom 404 Pro
- Affected
- up to 3.12.0
- What to do
- Affects up to 3.12.0. Update Custom 404 Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 22, 2025Feather Login Page: Cross-Site Request Forgery (CSRF)CVE-2025-62107 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in PluginOps Feather Login Page feather-login-page allows Cross Site Request Forgery.This issue affects Feather Login Page: from n/a through <= 1.1.7.
- Product
- Feather Login Page
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update Feather Login Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 20, 2025Web to SugarCRM Lead: Cross-Site Request ForgeryCVE-2025-13361 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Web to SugarCRM Lead plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation on the custom field deletion functionality. This makes it possible for unauthenticated attackers to delete custom fields via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Web to SugarCRM Lead
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Web to SugarCRM Lead to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 19, 2025Amazon affiliate lite: Cross-Site Request ForgeryCVE-2025-14734 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Amazon affiliate lite Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the 'ADAL_settings_page' function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Amazon affiliate lite
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Amazon affiliate lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 19, 2025WP DB Booster: Cross-Site Request ForgeryCVE-2025-14168 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP DB Booster plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing nonce validation on the cleanup_all AJAX action. This makes it possible for unauthenticated attackers to delete database records including post drafts, revisions, comments, and metadata via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- WP DB Booster
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update WP DB Booster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 19, 2025Quran Gateway: Cross-Site Request ForgeryCVE-2025-14164 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Quran Gateway plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing nonce validation in the quran_gateway_options function. This makes it possible for unauthenticated attackers to modify the plugin's display settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Quran Gateway
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Quran Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 19, 2025WP Hallo Welt: Cross-Site Request ForgeryCVE-2025-13365 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Hallo Welt plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or incorrect nonce validation on the 'hallo_welt_seite' function. This makes it possible for unauthenticated attackers to update plugin settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Due to the insufficient input sanitization and output escaping, this can lead to Stored Cross-Site Scripting.
- Product
- WP Hallo Welt
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update WP Hallo Welt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 19, 2025HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player: Server-Side Request ForgeryCVE-2025-13999 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions from 2.4.0 up to, and including, 2.5.1 via the getIcyMetadata() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- Product
- HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player
- Affected
- up to 2.5.1
- What to do
- Affects up to 2.5.1. Update HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 18, 2025Prime Slider – Addons for Elementor: Server-Side Request ForgeryCVE-2025-14277 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Prime Slider – Addons for Elementor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.0.9 via the import_elementor_template AJAX action. This makes it possible for authenticated attackers, with subscriber level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- Product
- Prime Slider – Addons for Elementor
- Affected
- up to 4.0.9
- What to do
- Affects up to 4.0.9. Update Prime Slider – Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 17, 2025Download Plugins and Themes in ZIP from Dashboard: Cross-Site Request ForgeryCVE-2025-14399 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Download Plugins and Themes in ZIP from Dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.6. This is due to missing or incorrect nonce validation on the download_plugin_bulk and download_theme_bulk functions. This makes it possible for unauthenticated attackers to archive all the sites plugins and themes and place them in the `wp-content/uploads/` directory via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Download Plugins and Themes in ZIP from Dashboard
- Affected
- up to 1.9.6
- What to do
- Affects up to 1.9.6. Update Download Plugins and Themes in ZIP from Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 16, 2025Meks Quick Plugin Disabler: Cross-Site Request Forgery (CSRF)CVE-2025-68083 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Meks Meks Quick Plugin Disabler meks-quick-plugin-disabler allows Cross Site Request Forgery.This issue affects Meks Quick Plugin Disabler: from n/a through <= 1.0.
- Product
- Meks Quick Plugin Disabler
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Meks Quick Plugin Disabler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Semrush Content Toolkit: Cross-Site Request Forgery (CSRF)CVE-2025-68082 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in SEMrush CY LTD Semrush Content Toolkit semrush-contentshake allows Cross Site Request Forgery.This issue affects Semrush Content Toolkit: from n/a through <= 1.1.32.
- Product
- Semrush Content Toolkit
- Affected
- up to 1.1.32
- What to do
- Affects up to 1.1.32. Update Semrush Content Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Kerge: Server-Side Request Forgery (SSRF)CVE-2025-67989 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Server-Side Request Forgery (SSRF) vulnerability in LMPixels Kerge kerge allows Server Side Request Forgery.This issue affects Kerge: from n/a through <= 4.1.3.
- Product
- Kerge
- Affected
- up to 4.1.3
- What to do
- Affects up to 4.1.3. Update Kerge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.