Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

585new WordPress flaws this week

391,310entries in the database

1,203 results · page 11 of 25

May 19, 2025Free Shipping Bar: Amount Left for Free Shipping for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48253 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Free Shipping Bar: Amount Left for Free Shipping for WooCommerce amount-left-free-shipping-woocommerce allows Stored XSS.This issue affects Free Shipping Bar: Amount Left for Free Shipping for WooCommerce: from n/a through <= 2.4.6.
Product
Free Shipping Bar: Amount Left for Free Shipping for WooCommerce
Affected
up to 2.4.6
What to do
Affects up to 2.4.6. Update Free Shipping Bar: Amount Left for Free Shipping for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Additional Custom Emails & Recipients for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48251 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Additional Custom Emails & Recipients for WooCommerce custom-emails-for-woocommerce allows Stored XSS.This issue affects Additional Custom Emails & Recipients for WooCommerce: from n/a through <= 3.5.1.
Product
Additional Custom Emails & Recipients for WooCommerce
Affected
up to 3.5.1
What to do
Affects up to 3.5.1. Update Additional Custom Emails & Recipients for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 17, 2025Jupiter X Core: Stored Cross-Site ScriptingCVE-2025-3888 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Jupiter X Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File inclusion in all versions up to, and including, 4.8.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the page with the included SVG file.
Product
Jupiter X Core
Affected
up to 4.8.12
What to do
Affects up to 4.8.12. Update Jupiter X Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 16, 2025Sharespine Woocommerce Connector: Missing AuthorizationCVE-2025-48128 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Sharespine Sharespine Woocommerce Connector sharespine-woocommerce-connector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sharespine Woocommerce Connector: from n/a through <= 4.7.55.
Product
Sharespine Woocommerce Connector
Affected
up to 4.7.55
What to do
Affects up to 4.7.55. Update Sharespine Woocommerce Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025Wordpress Auto Spinner: Missing AuthorizationCVE-2025-47534 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ValvePress Wordpress Auto Spinner wp-auto-spinner allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wordpress Auto Spinner: from n/a through <= 3.25.0.
Product
Wordpress Auto Spinner
Affected
up to 3.25.0
What to do
Affects up to 3.25.0. Update Wordpress Auto Spinner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025Pinterest Automatic Pin: Missing AuthorizationCVE-2025-39511 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ValvePress Pinterest Automatic Pin wp-pinterest-automatic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pinterest Automatic Pin: from n/a through <= 4.19.0.
Product
Pinterest Automatic Pin
Affected
up to 4.19.0
What to do
Affects up to 4.19.0. Update Pinterest Automatic Pin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025Pixel WordPress Form BuilderPlugin & Autoresponder: Cross-Site Request Forgery (CSRF)CVE-2025-31915 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in kamleshyadav Pixel WordPress Form BuilderPlugin & Autoresponder pixel-formbuilder allows Cross Site Request Forgery.This issue affects Pixel WordPress Form BuilderPlugin & Autoresponder: from n/a through <= 1.0.3.
Product
Pixel WordPress Form BuilderPlugin & Autoresponder
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Pixel WordPress Form BuilderPlugin & Autoresponder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 15, 2025Auth0-PHP provides the PHP SDK for Auth0 Authentication and Management APIs.CVE-2025-47275 · WordPress plugins & themes · reported by GitHubCritical 9.1
Auth0-PHP provides the PHP SDK for Auth0 Authentication and Management APIs. Starting in version 8.0.0-BETA1 and prior to version 8.14.0, session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Certain pre-conditions are required to be vulnerable to this issue: Applications using the Auth0-PHP SDK, or the Auth0/symfony, Auth0/laravel-auth0, and Auth0/wordpress SDKs that rely on the Auth0-PHP SDK; and session storage configured with CookieStore. Upgrade Auth0/Auth0-PHP to v8.14.0 to receive a patch. As an additional precautionary measure, rotating cookie encryption keys is recommended. Note that once updated, any previous session cookies will be rejected.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com github.com
May 15, 2025Spiritual Gifts Survey (and optional S.H.A.P.E survey): Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-0688 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Spiritual Gifts Survey (and optional S.H.A.P.E survey) WordPress plugin through 0.9.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users.
Product
Spiritual Gifts Survey (and optional S.H.A.P.E survey)
Affected
up to 0.9.10
What to do
Affects up to 0.9.10. Update Spiritual Gifts Survey (and optional S.H.A.P.E survey) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Spiritual Gifts Survey (and optional S.H.A.P.E survey): Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-0687 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Spiritual Gifts Survey (and optional S.H.A.P.E survey) WordPress plugin through 0.9.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users.
Product
Spiritual Gifts Survey (and optional S.H.A.P.E survey)
Affected
up to 0.9.10
What to do
Affects up to 0.9.10. Update Spiritual Gifts Survey (and optional S.H.A.P.E survey) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Maspik: Does not sanitise and escape some of its settingsCVE-2024-9182 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Maspik WordPress plugin before 2.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
Product
Maspik
Fixed in
2.1.3
What to do
Update Maspik to 2.1.3 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Real WP Shop Lite Ajax eCommerce Shopping Cart: Does not sanitise and escape some of its settingsCVE-2024-11140 · WordPress plugins & themes · reported by WPScanLow 3.5
The Real WP Shop Lite Ajax eCommerce Shopping Cart WordPress plugin through 2.0.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Real WP Shop Lite Ajax eCommerce Shopping Cart
Affected
up to 2.0.8
What to do
Affects up to 2.0.8. Update Real WP Shop Lite Ajax eCommerce Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Payment Gateway for Telcell: Does not validate the api_url parameter before redirecting the user to its valueCVE-2023-6786 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Payment Gateway for Telcell WordPress plugin through 2.0.1 does not validate the api_url parameter before redirecting the user to its value, leading to an Open Redirect issue
Product
Payment Gateway for Telcell
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Payment Gateway for Telcell to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
May 7, 2025WP Pipes: Server-Side Request Forgery (SSRF)CVE-2025-47664 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Server-Side Request Forgery (SSRF) vulnerability in ThimPress WP Pipes allows Server Side Request Forgery. This issue affects WP Pipes: from n/a through 1.4.2.
Product
WP Pipes
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update WP Pipes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025Spiraclethemes Site Library: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47656 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiracle Themes Spiraclethemes Site Library spiraclethemes-site-library allows Stored XSS.This issue affects Spiraclethemes Site Library: from n/a through <= 1.5.4.
Product
Spiraclethemes Site Library
Affected
up to 1.5.4
What to do
Affects up to 1.5.4. Update Spiraclethemes Site Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025JupiterX Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47475 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in artbees JupiterX Core jupiterx-core allows Stored XSS.This issue affects JupiterX Core: from n/a through <= 4.8.11.
Product
JupiterX Core
Affected
up to 4.8.11
What to do
Affects up to 4.8.11. Update JupiterX Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 6, 2025Slider & Popup Builder by Depicter: Generic SQL InjectionCVE-2025-2011 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Slider & Popup Builder by Depicter plugin for WordPress is vulnerable to generic SQL Injection via the ‘s' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Slider & Popup Builder by Depicter
Affected
up to 3.6.1
What to do
Affects up to 3.6.1. Update Slider & Popup Builder by Depicter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 2, 2025MStore API – Create Native Android & iOS Apps On The Cloud: Limited privilege escalationCVE-2025-3438 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and including, 4.17.4. This is due to a lack of restriction of role when registering. This makes it possible for unauthenticated attackers to to register with the 'wcfm_vendor' role, which is a Store Vendor role in the WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress. The vulnerability can only be exploited if the WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin is installed and activated. The vulnerability was partially patched in version 4.17.3.
Product
MStore API – Create Native Android & iOS Apps On The Cloud
Affected
up to 4.17.4
What to do
Affects up to 4.17.4. Update MStore API – Create Native Android & iOS Apps On The Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 1, 2025WordPress Simple Shopping Cart: Stored Cross-Site ScriptingCVE-2025-3890 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_cart_button' shortcode in all versions up to, and including, 5.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WordPress Simple Shopping Cart
Affected
up to 5.1.3
What to do
Affects up to 5.1.3. Update WordPress Simple Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 1, 2025WordPress Simple Shopping Cart: Insecure Direct Object ReferenceCVE-2025-3889 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.3 via the 'process_payment_data' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to change the quantity of a product to a negative number, which subtracts the product cost from the total order cost. The attack will only work with Manual Checkout mode, as PayPal and Stripe will not process payments for a negative quantity.
Product
WordPress Simple Shopping Cart
Affected
up to 5.1.3
What to do
Affects up to 5.1.3. Update WordPress Simple Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 1, 2025WordPress Simple Shopping Cart: Insecure Direct Object ReferenceCVE-2025-3874 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.3 due to lack of randomization of a user controlled key. This makes it possible for unauthenticated attackers to access customer shopping carts and edit product links, add or delete products, and discover coupon codes.
Product
WordPress Simple Shopping Cart
Affected
up to 5.1.3
What to do
Affects up to 5.1.3. Update WordPress Simple Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record developer.wordpress.org plugins.trac.wordpress.org
May 1, 2025Projectopia – WordPress Project Management: Unauthorized modification of data that can lead to a denial of serviceCVE-2025-3952 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Projectopia – WordPress Project Management plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'pto_remove_logo' function in all versions up to, and including, 5.1.16. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary option values on the WordPress site. This can be leveraged to delete an option that would create an error on the site and deny service to legitimate users.
Product
Projectopia – WordPress Project Management
Affected
up to 5.1.16
What to do
Affects up to 5.1.16. Update Projectopia – WordPress Project Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 26, 2025Jupiter X Core: PHP Object InjectionCVE-2025-2105 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Jupiter X Core plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.8.11 via deserialization of untrusted input from the 'file' parameter of the 'raven_download_file' function. This makes it possible for attackers to inject a PHP Object through a PHAR file. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. This vulnerability may be exploited by unauthenticated attackers when a form is present on the site with the file download action, and the ability to upload files is also present. Otherwise, this would be considered exploitable by Contributor-level users and above, because they could create the form needed to successfully exploit this.
Product
Jupiter X Core
Affected
up to 4.8.11
What to do
Affects up to 4.8.11. Update Jupiter X Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Apr 23, 2025WordPress Simple Shopping Cart: Product price manipulationCVE-2025-3530 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to product price manipulation in all versions up to, and including, 5.1.2. This is due to a logic flaw involving the inconsistent use of parameters during the cart addition process. The plugin uses the parameter 'product_tmp_two' for computing a security hash against price tampering while using 'wspsc_product' to display the product, allowing an unauthenticated attacker to substitute details from a cheaper product and bypass payment for a more expensive item.
Product
WordPress Simple Shopping Cart
Affected
up to 5.1.2
What to do
Affects up to 5.1.2. Update WordPress Simple Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 23, 2025WordPress Simple Shopping Cart: Sensitive Information ExposureCVE-2025-3529 · WordPress plugins & themes · reported by WordfenceHigh 8.2
The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.1.2 via the 'file_url' parameter. This makes it possible for unauthenticated attackers to view potentially sensitive information and download a digital product without paying for it.
Product
WordPress Simple Shopping Cart
Affected
up to 5.1.2
What to do
Affects up to 5.1.2. Update WordPress Simple Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 17, 2025Piotnet Addons For Elementor: Stored Cross-Site ScriptingCVE-2024-13650 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'PAFE Before After Image Comparison Slider' widget in all versions up to, and including, 2.4.36 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Piotnet Addons For Elementor
Affected
up to 2.4.36
What to do
Affects up to 2.4.36. Update Piotnet Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Apr 17, 2025Spice Blocks: Missing AuthorizationCVE-2025-39532 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in spicethemes Spice Blocks spice-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spice Blocks: from n/a through <= 2.0.7.7.
Product
Spice Blocks
Affected
up to 2.0.7.7
What to do
Affects up to 2.0.7.7. Update Spice Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025Projectopia: Incorrect Privilege AssignmentCVE-2025-32648 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in Projectopia Projectopia projectopia-core allows Privilege Escalation.This issue affects Projectopia: from n/a through <= 5.1.24.
Product
Projectopia
Affected
up to 5.1.24
What to do
Affects up to 5.1.24. Update Projectopia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025AWSA Shipping: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32604 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sajjad Aslani AWSA Shipping awsa-shipping allows Reflected XSS.This issue affects AWSA Shipping: from n/a through <= 1.3.0.
Product
AWSA Shipping
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update AWSA Shipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025DN Shipping by Weight for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32535 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in digireturn DN Shipping by Weight for WooCommerce dn-shipping-by-weight allows Reflected XSS.This issue affects DN Shipping by Weight for WooCommerce: from n/a through <= 1.2.
Product
DN Shipping by Weight for WooCommerce
Affected
up to 1.2
What to do
Affects up to 1.2. Update DN Shipping by Weight for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025Shipping with Venipak for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24553 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Akadrama Shipping with Venipak for WooCommerce wc-venipak-shipping allows Reflected XSS.This issue affects Shipping with Venipak for WooCommerce: from n/a through <= 1.22.3.
Product
Shipping with Venipak for WooCommerce
Affected
up to 1.22.3
What to do
Affects up to 1.22.3. Update Shipping with Venipak for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025SpiderDisplay: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23855 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fyljp SpiderDisplay spiderdisplay allows Reflected XSS.This issue affects SpiderDisplay: from n/a through <= 1.9.1.
Product
SpiderDisplay
Affected
up to 1.9.1
What to do
Affects up to 1.9.1. Update SpiderDisplay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 16, 2025Conditional Shipping for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-39564 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in WP Trio Conditional Shipping for WooCommerce conditional-shipping-for-woocommerce allows Cross Site Request Forgery.This issue affects Conditional Shipping for WooCommerce: from n/a through <= 3.4.0.
Product
Conditional Shipping for WooCommerce
Affected
up to 3.4.0
What to do
Affects up to 3.4.0. Update Conditional Shipping for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 16, 2025WordPress REST API Authentication: Missing AuthorizationCVE-2025-39545 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in miniOrange WordPress REST API Authentication wp-rest-api-authentication allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress REST API Authentication: from n/a through <= 3.6.3.
Product
WordPress REST API Authentication
Affected
up to 3.6.3
What to do
Affects up to 3.6.3. Update WordPress REST API Authentication to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 15, 2025Advanced Custom Fields: Link Picker Field: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26746 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in caalami Advanced Custom Fields: Link Picker Field acf-link-picker-field allows Reflected XSS.This issue affects Advanced Custom Fields: Link Picker Field: from n/a through <= 1.2.8.
Product
Advanced Custom Fields: Link Picker Field
Affected
up to 1.2.8
What to do
Affects up to 1.2.8. Update Advanced Custom Fields: Link Picker Field to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 11, 2025WooCommerce Pickupp: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-32587 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in pickupp WooCommerce Pickupp wc-pickupp allows PHP Local File Inclusion.This issue affects WooCommerce Pickupp: from n/a through <= 2.4.3.
Product
WooCommerce Pickupp
Affected
up to 2.4.3
What to do
Affects up to 2.4.3. Update WooCommerce Pickupp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 11, 2025EmpikPlace for Woocommerce: Deserialization of Untrusted DataCVE-2025-32568 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in empik EmpikPlace for Woocommerce empik-for-woocommerce allows Object Injection.This issue affects EmpikPlace for Woocommerce: from n/a through <= 1.4.3.
Product
EmpikPlace for Woocommerce
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update EmpikPlace for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 10, 2025Spider Elements: Missing AuthorizationCVE-2025-32216 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Missing Authorization vulnerability in Spider Themes Spider Elements spider-elements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spider Elements: from n/a through <= 1.6.6.
Product
Spider Elements
Affected
up to 1.6.6
What to do
Affects up to 1.6.6. Update Spider Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 10, 2025Piotnet Forms: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-32205 · WordPress plugins & themes · reported by PatchstackLow 2.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in piotnetdotcom Piotnet Forms piotnetforms.This issue affects Piotnet Forms: from n/a through <= 1.0.30.
Product
Piotnet Forms
Affected
up to 1.0.30
What to do
Affects up to 1.0.30. Update Piotnet Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 10, 2025Popping Content Light: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32115 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Popping Content Light popping-content-light allows Reflected XSS.This issue affects Popping Content Light: from n/a through <= 2.4.
Product
Popping Content Light
Affected
up to 2.4
What to do
Affects up to 2.4. Update Popping Content Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 4, 2025AI Content Pipelines: Stored Cross-Site ScriptingCVE-2025-2544 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The AI Content Pipelines plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
AI Content Pipelines
Affected
up to 1.6
What to do
Affects up to 1.6. Update AI Content Pipelines to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 4, 2025Piotnet Addons For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32197 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in piotnetdotcom Piotnet Addons For Elementor piotnet-addons-for-elementor allows Stored XSS.This issue affects Piotnet Addons For Elementor: from n/a through <= 2.4.36.
Product
Piotnet Addons For Elementor
Affected
up to 2.4.36
What to do
Affects up to 2.4.36. Update Piotnet Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 4, 2025Ecwid Shopping Cart: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32195 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ecwid by Lightspeed Ecommerce Shopping Cart Ecwid Shopping Cart ecwid-shopping-cart allows Stored XSS.This issue affects Ecwid Shopping Cart: from n/a through <= 7.0.
Product
Ecwid Shopping Cart
Affected
up to 7.0
What to do
Affects up to 7.0. Update Ecwid Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 4, 2025Spider Elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32182 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spider Themes Spider Elements spider-elements allows Stored XSS.This issue affects Spider Elements: from n/a through <= 1.6.5.
Product
Spider Elements
Affected
up to 1.6.5
What to do
Affects up to 1.6.5. Update Spider Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 4, 2025FunnelCockpit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32132 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FunnelCockpit FunnelCockpit funnelcockpit allows Stored XSS.This issue affects FunnelCockpit: from n/a through <= 1.4.3.
Product
FunnelCockpit
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update FunnelCockpit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 3, 2025Shopify to WooCommerce Migration: Missing AuthorizationCVE-2025-31795 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Plugin Devs Shopify to WooCommerce Migration migrate-shopify-to-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shopify to WooCommerce Migration: from n/a through <= 1.3.0.
Product
Shopify to WooCommerce Migration
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Shopify to WooCommerce Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025ShortPixel Adaptive Images: Missing AuthorizationCVE-2025-30853 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in ShortPixel ShortPixel Adaptive Images shortpixel-adaptive-images allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShortPixel Adaptive Images: from n/a through <= 3.10.0.
Product
ShortPixel Adaptive Images
Affected
up to 3.10.0
What to do
Affects up to 3.10.0. Update ShortPixel Adaptive Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Simple Map No Api: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31890 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mashi Simple Map No Api simple-map-no-api allows Stored XSS.This issue affects Simple Map No Api: from n/a through <= 1.9.
Product
Simple Map No Api
Affected
up to 1.9
What to do
Affects up to 1.9. Update Simple Map No Api to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025SMM API: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31855 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in softnwords SMM API smm-api allows Stored XSS.This issue affects SMM API: from n/a through <= 6.0.31.
Product
SMM API
Affected
up to 6.0.31
What to do
Affects up to 6.0.31. Update SMM API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025OwnerRez API: Cross-Site Request Forgery (CSRF)CVE-2025-31814 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in OwnerRez OwnerRez API ownerrez allows Cross Site Request Forgery.This issue affects OwnerRez API: from n/a through <= 1.2.0.
Product
OwnerRez API
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update OwnerRez API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.