Updated 10 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

1,597 results · page 12 of 32

Aug 23, 2025Wptobe-memberships: Arbitrary file deletionCVE-2025-9048 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Wptobe-memberships plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the del_img_ajax_call() function in all versions up to, and including, 3.4.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
Wptobe-memberships
Affected
up to 3.4.2
What to do
Affects up to 3.4.2. Update Wptobe-memberships to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Aug 21, 2025WP Webhooks: Arbitrary file copyCVE-2025-8895 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP Webhooks plugin for WordPress is vulnerable to arbitrary file copy due to missing validation of user-supplied input in all versions up to, and including, 3.3.5. This makes it possible for unauthenticated attackers to copy arbitrary files on the affected site's server to arbitrary locations. This can be used to copy the contents of wp-config.php into a text file which can then be accessed in a browser to reveal database credentials.
Product
WP Webhooks
Affected
up to 3.3.5
What to do
Affects up to 3.3.5. Update WP Webhooks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 19, 2025Redirection for Contact Form 7: Arbitrary file deletionCVE-2025-8141 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_associated_files function in all versions up to, and including, 3.2.4. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
Redirection for Contact Form 7
Affected
up to 3.2.4
What to do
Affects up to 3.2.4. Update Redirection for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 19, 2025Media Library Assistant: Arbitrary file deletion in the /wp-content/uploads directoryCVE-2025-8357 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Media Library Assistant plugin for WordPress is vulnerable to arbitrary file deletion in the /wp-content/uploads directory due to insufficient file path validation and user capability checking in the _process_mla_download_file function in all versions up to, and including, 3.27. This makes it possible for authenticated attackers, with Author-level access and above, to delete arbitrary files on the server from the /wp-content/uploads/ directory.
Product
Media Library Assistant
Affected
up to 3.27
What to do
Affects up to 3.27. Update Media Library Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 16, 2025The Soledad: Arbitrary shortcode executionCVE-2025-8105 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The Soledad theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.6.7. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The Soledad
Affected
up to 8.6.7
What to do
Affects up to 8.6.7. Update The Soledad to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Aug 16, 2025StoryChief: Arbitrary file uploadsCVE-2025-7441 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The StoryChief plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.0.42. This vulnerability occurs through the /wp-json/storychief/webhook REST-API endpoint that does not have sufficient filetype validation. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
StoryChief
Affected
up to 1.0.42
What to do
Affects up to 1.0.42. Update StoryChief to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 16, 2025School Management System for: Arbitrary file uploadsCVE-2025-6079 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The School Management System for Wordpress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the homework.php file in all versions up to, and including, 93.2.0. This makes it possible for authenticated attackers, with Student-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. CVE-2025-31100 is potentially a duplicate of this.
Product
School Management System for
Affected
up to 93.2.0
What to do
Affects up to 93.2.0. Update School Management System for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Aug 15, 2025Icons Factory: Arbitrary File DeletionCVE-2025-7778 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Icons Factory plugin for WordPress is vulnerable to Arbitrary File Deletion due to insufficient authorization and improper path validation within the delete_files() function in all versions up to, and including, 1.6.12. This makes it possible for unauthenticated attackers to to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
Icons Factory
Affected
up to 1.6.12
What to do
Affects up to 1.6.12. Update Icons Factory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 15, 2025Assistant for NextGEN Gallery: Arbitrary directory deletionCVE-2025-7641 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Assistant for NextGEN Gallery plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation in the /wp-json/nextgenassistant/v1.0.0/control REST endpoint in all versions up to, and including, 1.0.9. This makes it possible for unauthenticated attackers to delete arbitrary directories on the server, which can cause a complete loss of availability.
Product
Assistant for NextGEN Gallery
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update Assistant for NextGEN Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 15, 2025Bit Form builder: Arbitrary file uploadsCVE-2025-6679 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Bit Form builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 2.20.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. For this to be exploitable, the PRO version needs to be installed and activated as well. Additionally a form with an advanced file upload element needs to be published.
Product
Bit Form builder
Affected
up to 2.20.4
What to do
Affects up to 2.20.4. Update Bit Form builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 12, 2025B Slider- Gutenberg Slider Block for WP: Arbitrary Plugin InstallationCVE-2025-8418 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The B Slider- Gutenberg Slider Block for WP plugin for WordPress is vulnerable to Arbitrary Plugin Installation in all versions up to, and including, 1.1.30. This is due to missing capability checks on the activated_plugin function. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins on the server which can make remote code execution possible.
Product
B Slider- Gutenberg Slider Block for WP
Affected
up to 1.1.30
What to do
Affects up to 1.1.30. Update B Slider- Gutenberg Slider Block for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 12, 2025Elementor: Arbitrary File ReadCVE-2025-8081 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Elementor plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.30.2 via the Import_Images::import() function due to insufficient controls on the filename specified. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
Elementor
Affected
up to 3.30.2
What to do
Affects up to 3.30.2. Update Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Aug 12, 2025UiCore Elements – Free Elementor widgets and templates: Arbitrary File ReadCVE-2025-6253 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The UiCore Elements – Free Elementor widgets and templates plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.3.0 via the prepare_template() function due to a missing capability check and insufficient controls on the filename specified. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
UiCore Elements – Free Elementor widgets and templates
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update UiCore Elements – Free Elementor widgets and templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 11, 2025WooCommerce Purchase Orders: Arbitrary file deletionCVE-2025-5391 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The WooCommerce Purchase Orders plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_file() function in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
WooCommerce Purchase Orders
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update WooCommerce Purchase Orders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 5, 2025upload.php: The WordPress plugin Asset-Manager version 2.0 and below contains an unauthenticated arbitrary file uploadCVE-2012-10026 · WordPress plugins & themes · reported by VulnCheckCritical 10
The WordPress plugin Asset-Manager version 2.0 and below contains an unauthenticated arbitrary file upload vulnerability in upload.php. The endpoint fails to properly validate and restrict uploaded file types, allowing remote attackers to upload malicious PHP scripts to a predictable temporary directory. Once uploaded, the attacker can execute the file via a direct HTTP GET request, resulting in remote code execution under the web server’s context.
Product
upload.php
What to do
Update upload.php to the newest version.
Full record and what to do →NVD record web.archive.org raw.githubusercontent.com
Aug 5, 2025WP Import Export Lite: Arbitrary file uploadsCVE-2025-6207 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpie_tempalte_import' function in all versions up to, and including, 3.9.28. This makes it possible for authenticated attackers, with Subscriber-level access and above, and permissions granted by an Administrator, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
WP Import Export Lite
Affected
up to 3.9.28
What to do
Affects up to 3.9.28. Update WP Import Export Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 5, 2025WP Import Export Lite: Arbitrary file uploadsCVE-2025-5061 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpie_parse_upload_data' function in all versions up to, and including, 3.9.29. This makes it possible for authenticated attackers, with Subscriber-level access and above, and permissions granted by an Administrator, to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability was partially patched in version 3.9.29.
Product
WP Import Export Lite
Affected
up to 3.9.29
What to do
Affects up to 3.9.29. Update WP Import Export Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 2, 2025Woffice Core: Arbitrary file deletionCVE-2025-7694 · WordPress plugins & themes · reported by WordfenceMedium 6.8
The Woffice Core plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the woffice_file_manager_delete() function in all versions up to, and including, 5.4.26. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
Woffice Core
Affected
up to 5.4.26
What to do
Affects up to 5.4.26. Update Woffice Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record hub.woffice.io themeforest.net
Aug 1, 2025BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript: Arbitrary file uploadsCVE-2025-7443 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the store_javascript_cache.php file in all versions up to, and including, 2.2.42. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript
Affected
up to 2.2.42
What to do
Affects up to 2.2.42. Update BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 31, 2025NinjaScanner – Virus & Malware scan: Arbitrary file deletionCVE-2025-8213 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The NinjaScanner – Virus & Malware scan plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'nscan_ajax_quarantine' and 'nscan_quarantine_select' functions in all versions up to, and including, 3.2.5. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, including files outside the WordPress root directory.
Product
NinjaScanner – Virus & Malware scan
Affected
up to 3.2.5
What to do
Affects up to 3.2.5. Update NinjaScanner – Virus & Malware scan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 31, 2025AI Engine: Arbitrary file uploadsCVE-2025-7847 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The AI Engine plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the rest_simpleFileUpload() function in versions 2.9.3 and 2.9.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server when the REST API is enabled, which may make remote code execution possible.
Product
AI Engine
What to do
Update AI Engine to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 26, 2025Kallyas: Arbitrary folder deletionCVE-2025-6989 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Kallyas theme for WordPress is vulnerable to arbitrary folder deletion due to insufficient file path validation in the delete_font() function in all versions up to, and including, 4.21.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary folders on the server.
Product
Kallyas
Affected
up to 4.21.0
What to do
Affects up to 4.21.0. Update Kallyas to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Jul 25, 2025Droip: Arbitrary file uploadsCVE-2025-5831 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Droip plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the make_google_font_offline() function in all versions up to, and excluding, 2.5.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Droip
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update Droip to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record droip.com wordfence.com
Jul 24, 2025Responsive Thumbnail Slider: Arbitrary file uploadsCVE-2015-10144 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Responsive Thumbnail Slider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type sanitization in the via the image uploader in versions up to 1.0.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected sites server using a double extension which may make remote code execution possible.
Product
Responsive Thumbnail Slider
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Responsive Thumbnail Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cxsecurity.com raw.githubusercontent.com
Jul 24, 2025Security Ninja – WordPress Security Plugin & Firewall: Arbitrary File ReadCVE-2025-8009 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Security Ninja – WordPress Security Plugin & Firewall plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.242 via the 'get_file_source' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to extract sensitive data, including the contents of any file on the server.
Product
Security Ninja – WordPress Security Plugin & Firewall
Affected
up to 5.242
What to do
Affects up to 5.242. Update Security Ninja – WordPress Security Plugin & Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 24, 2025WPBookit: Arbitrary file uploadsCVE-2025-7852 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image_upload_handle() function hooked via the 'add_new_customer' route in all versions up to, and including, 1.0.6. The plugin’s image‐upload handler calls move_uploaded_file() on client‐supplied files without restricting allowed extensions or MIME types, nor sanitizing the filename. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
WPBookit
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update WPBookit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 24, 2025Ebook Store: Arbitrary file uploadsCVE-2025-7437 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Ebook Store plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ebook_store_save_form function in all versions up to, and including, 5.8012. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Ebook Store
Affected
up to 5.8012
What to do
Affects up to 5.8012. Update Ebook Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 22, 2025Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection): Arbitrary file deletionCVE-2025-7645 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete-file' field in all versions up to, and including, 3.2.8. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, when an administrator deletes the submission, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection)
Affected
up to 3.2.8
What to do
Affects up to 3.2.8. Update Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jul 21, 2025Website Contact Form With File Upload: Arbitrary file uploadsCVE-2015-10137 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Website Contact Form With File Upload plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload_file()' function in versions up to, and including, 1.3.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.
Product
Website Contact Form With File Upload
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update Website Contact Form With File Upload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Jul 21, 2025FoxyPress: Arbitrary file uploadsCVE-2012-10020 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The FoxyPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadify.php file in versions up to, and including, 0.4.2.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.
Product
FoxyPress
Affected
up to 0.4.2.1
What to do
Affects up to 0.4.2.1. Update FoxyPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Jul 19, 2025Work The Flow File Upload: Arbitrary file uploadsCVE-2015-10138 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Work The Flow File Upload plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the jQuery-File-Upload-9.5.0 server and test files in versions up to, and including, 2.5.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.
Product
Work The Flow File Upload
Affected
up to 2.5.2
What to do
Affects up to 2.5.2. Update Work The Flow File Upload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Jul 19, 2025WP Mobile Detector: Arbitrary file uploadsCVE-2016-15043 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP Mobile Detector plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in resize.php file in versions up to, and including, 3.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.
Product
WP Mobile Detector
Affected
up to 3.5
What to do
Affects up to 3.5. Update WP Mobile Detector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record aadityapurani.com blog.sucuri.net
Jul 19, 2025WPshop 2 – E-Commerce: Arbitrary file uploadsCVE-2015-10135 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajaxUpload function in versions before 1.3.9.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.
Product
WPshop 2 – E-Commerce
Fixed in
1.3.9.6
What to do
Update WPshop 2 – E-Commerce to 1.3.9.6 or newer.
Full record and what to do →NVD record g0blin.co.uk github.com
Jul 19, 2025Simple Backup: Arbitrary File DownloadCVE-2015-10134 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Simple Backup plugin for WordPress is vulnerable to Arbitrary File Download in versions up to, and including, 2.7.10. via the download_backup_file function. This is due to a lack of capability checks and file type validation. This makes it possible for attackers to download sensitive files such as the wp-config.php file from the affected site.
Product
Simple Backup
Affected
up to 2.7.10
What to do
Affects up to 2.7.10. Update Simple Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordfence.com
Jul 19, 2025Front End Editor: Arbitrary file uploadsCVE-2012-10019 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Front End Editor plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the upload.php file in versions before 2.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.
Product
Front End Editor
Fixed in
2.3
What to do
Update Front End Editor to 2.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Jul 18, 2025Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal: Arbitrary File ReadCVE-2025-7772 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 16.8 via the wpmr_inspect_file() function due to a missing capability check. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal
Affected
up to 16.8
What to do
Affects up to 16.8. Update Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 18, 2025MasterStudy LMS Pro: Arbitrary file uploadsCVE-2025-7438 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The MasterStudy LMS Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'install_and_activate_plugin' function in all versions up to, and including, 4.7.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability is difficult to exploit due to timing requirements and environmental factors.
Product
MasterStudy LMS Pro
Affected
up to 4.7.9
What to do
Affects up to 4.7.9. Update MasterStudy LMS Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record docs.stylemixthemes.com wordfence.com
Jul 18, 2025Attachment Manager: Arbitrary file deletionCVE-2025-7643 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Attachment Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the handle_actions() function in all versions up to, and including, 2.1.2. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
Attachment Manager
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Attachment Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jul 18, 2025WooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet: Arbitrary file uploadsCVE-2025-6222 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'ced_rnx_order_exchange_attach_files' function in all versions up to, and including, 3.2.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
WooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet
Affected
up to 3.2.6
What to do
Affects up to 3.2.6. Update WooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jul 16, 2025Madara - Core: Arbitrary file deletionCVE-2025-7712 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Madara - Core plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wp_manga_delete_zip() function in all versions up to, and including, 2.2.3. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
Madara - Core
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update Madara - Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record mangabooth.com wordfence.com
Jul 16, 2025Counter live visitors for WooCommerce: Arbitrary file deletionCVE-2025-7359 · WordPress plugins & themes · reported by WordfenceHigh 8.2
The Counter live visitors for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wcvisitor_get_block function in all versions up to, and including, 1.3.6. This makes it possible for unauthenticated attackers to delete arbitrary files on the server. NOTE: This particular vulnerability deletes all the files in a targeted arbitrary directory rather than a specified arbitrary file, which can lead to loss of data or a denial of service condition.
Product
Counter live visitors for WooCommerce
Affected
up to 1.3.6
What to do
Affects up to 1.3.6. Update Counter live visitors for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 16, 2025Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal: Arbitrary File DeletionCVE-2025-6043 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal plugin for WordPress is vulnerable to Arbitrary File Deletion due to a missing capability check on the wpmr_delete_file() function in all versions up to, and including, 17.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files making remote code execution possible. This is only exploitable when advanced mode is enabled on the site.
Product
Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal
Affected
up to 17.0
What to do
Affects up to 17.0. Update Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 15, 2025HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder: Arbitrary file movingCVE-2025-7360 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary file moving due to insufficient file path validation in the handle_files_upload() function in all versions up to, and including, 2.2.1. This makes it possible for unauthenticated attackers to move arbitrary files on the server, which can easily lead to remote code execution when the right file is moved (such as wp-config.php).
Product
HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jul 15, 2025HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder: Arbitrary file deletionCVE-2025-7341 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the temp_file_delete() function in all versions up to, and including, 2.2.1. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 15, 2025HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder: Arbitrary file uploadsCVE-2025-7340 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the temp_file_upload() function in all versions up to, and including, 2.2.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 15, 2025Alone – Charity Multipurpose Non-profit: Arbitrary file uploadsCVE-2025-5394 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Alone – Charity Multipurpose Non-profit WordPress Theme theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the alone_import_pack_install_plugin() function in all versions up to, and including, 7.8.3. This makes it possible for unauthenticated attackers to upload zip files containing webshells disguised as plugins from remote locations to achieve remote code execution. CVE-2025-54019 is likely a duplicate of this.
Product
Alone – Charity Multipurpose Non-profit
Affected
up to 7.8.3
What to do
Affects up to 7.8.3. Update Alone – Charity Multipurpose Non-profit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Jul 15, 2025Alone – Charity Multipurpose Non-profit: Arbitrary file deletionCVE-2025-5393 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Alone – Charity Multipurpose Non-profit WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the alone_import_pack_restore_data() function in all versions up to, and including, 7.8.5. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This was partially patched in 7.8.5 and has been fully addresses in 7.8.7.
Product
Alone – Charity Multipurpose Non-profit
Affected
up to 7.8.5
What to do
Affects up to 7.8.5. Update Alone – Charity Multipurpose Non-profit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Jul 12, 2025AIT CSV import/export: Arbitrary file uploadsCVE-2020-36849 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The AIT CSV import/export plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the /wp-content/plugins/ait-csv-import-export/admin/upload-handler.php file in versions up to, and including, 3.0.3. This makes it possible for unauthorized attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.
Product
AIT CSV import/export
Affected
up to 3.0.3
What to do
Affects up to 3.0.3. Update AIT CSV import/export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com raw.githubusercontent.com
Jul 12, 2025BeeTeam368 Extensions: Arbitrary file uploadsCVE-2025-6423 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The BeeTeam368 Extensions plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the handle_submit_upload_file() function in all versions up to, and including, 2.3.5. This makes it possible for authenticated attackers with Subscriber-level access or higher to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
BeeTeam368 Extensions
Affected
up to 2.3.5
What to do
Affects up to 2.3.5. Update BeeTeam368 Extensions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Jul 12, 2025WPBookit: Arbitrary file uploadsCVE-2025-6058 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image_upload_handle() function hooked via the 'add_booking_type' route in all versions up to, and including, 1.0.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
WPBookit
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update WPBookit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.