Vulnerability database

1,019 results · page 12 of 21

• Jan 27, 2025Small Package Quotes – Worldwide Express Edition: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24667 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in enituretechnology Small Package Quotes – Worldwide Express Edition small-package-quotes-wwe-edition allows SQL Injection.This issue affects Small Package Quotes – Worldwide Express Edition: from n/a through <= 5.2.17.

  Product

  Small Package Quotes – Worldwide Express Edition

  Affected

  up to 5.2.17

  What to do

  Affects up to 5.2.17. Update Small Package Quotes – Worldwide Express Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 27, 2025Small Package Quotes – Unishippers Edition: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24665 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in enituretechnology Small Package Quotes – Unishippers Edition small-package-quotes-unishippers-edition allows SQL Injection.This issue affects Small Package Quotes – Unishippers Edition: from n/a through <= 2.4.8.

  Product

  Small Package Quotes – Unishippers Edition

  Affected

  up to 2.4.8

  What to do

  Affects up to 2.4.8. Update Small Package Quotes – Unishippers Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 27, 2025LTL Freight Quotes – Worldwide Express Edition: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24664 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in enituretechnology LTL Freight Quotes – Worldwide Express Edition ltl-freight-quotes-worldwide-express-edition allows SQL Injection.This issue affects LTL Freight Quotes – Worldwide Express Edition: from n/a through <= 5.0.20.

  Product

  LTL Freight Quotes – Worldwide Express Edition

  Affected

  up to 5.0.20

  What to do

  Affects up to 5.0.20. Update LTL Freight Quotes – Worldwide Express Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 27, 2025Shipping for Nova Poshta: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24612 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ihor Kit Shipping for Nova Poshta nova-poshta-ttn allows SQL Injection.This issue affects Shipping for Nova Poshta: from n/a through <= 1.19.6.

  Product

  Shipping for Nova Poshta

  Affected

  up to 1.19.6

  What to do

  Affects up to 1.19.6. Update Shipping for Nova Poshta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Bug Library: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24728 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yannick Lefebvre Bug Library bug-library allows Blind SQL Injection.This issue affects Bug Library: from n/a through <= 2.1.4.

  Product

  Bug Library

  Affected

  up to 2.1.4

  What to do

  Affects up to 2.1.4. Update Bug Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025RSVP and Event Management: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24683 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Chill RSVP and Event Management rsvp allows SQL Injection.This issue affects RSVP and Event Management: from n/a through <= 2.7.14.

  Product

  RSVP and Event Management

  Affected

  up to 2.7.14

  What to do

  Affects up to 2.7.14. Update RSVP and Event Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Form Builder CP: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24672 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in codepeople Form Builder CP cp-easy-form-builder allows SQL Injection.This issue affects Form Builder CP: from n/a through <= 1.2.41.

  Product

  Form Builder CP

  Affected

  up to 1.2.41

  What to do

  Affects up to 1.2.41. Update Form Builder CP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025SERPed.net: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24669 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in serpednet SERPed.net serped-net allows SQL Injection.This issue affects SERPed.net: from n/a through <= 4.4.

  Product

  SERPed.net

  Affected

  up to 4.4

  What to do

  Affects up to 4.4. Update SERPed.net to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Simple Download Monitor: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24663 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mra13 Simple Download Monitor simple-download-monitor allows Blind SQL Injection.This issue affects Simple Download Monitor: from n/a through <= 3.9.25.

  Product

  Simple Download Monitor

  Affected

  up to 3.9.25

  What to do

  Affects up to 3.9.25. Update Simple Download Monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025WPDM – Premium Packages: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24659 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjada WPDM – Premium Packages wpdm-premium-packages allows Blind SQL Injection.This issue affects WPDM – Premium Packages: from n/a through <= 5.9.6.

  Product

  WPDM – Premium Packages

  Affected

  up to 5.9.6

  What to do

  Affects up to 5.9.6. Update WPDM – Premium Packages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 24, 2025Email Subscription Popup: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24587 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nks Email Subscription Popup email-subscribe allows Blind SQL Injection.This issue affects Email Subscription Popup: from n/a through <= 1.2.23.

  Product

  Email Subscription Popup

  Affected

  up to 1.2.23

  What to do

  Affects up to 1.2.23. Update Email Subscription Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025WordPress Local SEO: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-23931 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Oliver Fuhrmann WordPress Local SEO dh-local-seo allows Blind SQL Injection.This issue affects WordPress Local SEO: from n/a through <= 2.3.

  Product

  WordPress Local SEO

  Affected

  up to 2.3

  What to do

  Affects up to 2.3. Update WordPress Local SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Menus Plus+: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-23910 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in keighl Menus Plus+ menus-plus allows SQL Injection.This issue affects Menus Plus+: from n/a through <= 1.9.6.

  Product

  Menus Plus+

  Affected

  up to 1.9.6

  What to do

  Affects up to 1.9.6. Update Menus Plus+ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Contact Form 7 Round Robin Lead Distribution: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-23784 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Jeffrey Contact Form 7 Round Robin Lead Distribution contact-form-7-round-robin-lead-distribution allows SQL Injection.This issue affects Contact Form 7 Round Robin Lead Distribution: from n/a through <= 1.2.1.

  Product

  Contact Form 7 Round Robin Lead Distribution

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update Contact Form 7 Round Robin Lead Distribution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025Taskbuilder: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22716 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in taskbuilder Taskbuilder taskbuilder allows SQL Injection.This issue affects Taskbuilder: from n/a through <= 3.0.6.

  Product

  Taskbuilder

  Affected

  up to 3.0.6

  What to do

  Affects up to 3.0.6. Update Taskbuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025Smart Manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22710 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in storeapps Smart Manager smart-manager-for-wp-e-commerce allows Blind SQL Injection.This issue affects Smart Manager: from n/a through <= 8.52.0.

  Product

  Smart Manager

  Affected

  up to 8.52.0

  What to do

  Affects up to 8.52.0. Update Smart Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025Multiple Carousel: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22553 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in dhananjaysingh Multiple Carousel multicarousel allows SQL Injection.This issue affects Multiple Carousel: from n/a through <= 2.0.

  Product

  Multiple Carousel

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update Multiple Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025Fancy Product Designer: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51818 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in radykal Fancy Product Designer fancy-product-designer.This issue affects Fancy Product Designer: from n/a through <= 6.4.3.

  Product

  Fancy Product Designer

  Affected

  up to 6.4.3

  What to do

  Affects up to 6.4.3. Update Fancy Product Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025ARPrice: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-49666 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in reputeinfosystems ARPrice arprice allows SQL Injection.This issue affects ARPrice: from n/a through <= 4.1.3.

  Product

  ARPrice

  Affected

  up to 4.1.3

  What to do

  Affects up to 4.1.3. Update ARPrice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025ARPrice: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-49655 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in reputeinfosystems ARPrice arprice allows SQL Injection.This issue affects ARPrice: from n/a through <= 4.1.3.

  Product

  ARPrice

  Affected

  up to 4.1.3

  What to do

  Affects up to 4.1.3. Update ARPrice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025Hero Mega Menu - Responsive WordPress Menu: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-49333 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NotFound Hero Mega Menu - Responsive WordPress Menu Plugin allows SQL Injection. This issue affects Hero Mega Menu - Responsive WordPress Menu Plugin: from n/a through 1.16.5.

  Product

  Hero Mega Menu - Responsive WordPress Menu

  Affected

  up to 1.16.5

  What to do

  Affects up to 1.16.5. Update Hero Mega Menu - Responsive WordPress Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025Hero Mega Menu - Responsive WordPress Menu: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-49303 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NotFound Hero Mega Menu - Responsive WordPress Menu Plugin allows SQL Injection. This issue affects Hero Mega Menu - Responsive WordPress Menu Plugin: from n/a through 1.16.5.

  Product

  Hero Mega Menu - Responsive WordPress Menu

  Affected

  up to 1.16.5

  What to do

  Affects up to 1.16.5. Update Hero Mega Menu - Responsive WordPress Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025WordPress Google Map Professional: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-23913 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in pankajpragma WordPress Google Map Professional google-map-professional allows SQL Injection.This issue affects WordPress Google Map Professional: from n/a through <= 1.0.

  Product

  WordPress Google Map Professional

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update WordPress Google Map Professional to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025WordPress Custom Sidebar: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-23912 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Philipp Speck WordPress Custom Sidebar wordpress-custom-sidebar allows Blind SQL Injection.This issue affects WordPress Custom Sidebar: from n/a through <= 2.3.

  Product

  WordPress Custom Sidebar

  Affected

  up to 2.3

  What to do

  Affects up to 2.3. Update WordPress Custom Sidebar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Solidres – Hotel booking: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-23911 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in solidres Solidres – Hotel booking plugin solidres allows SQL Injection.This issue affects Solidres – Hotel booking plugin: from n/a through <= 0.9.4.

  Product

  Solidres – Hotel booking

  Affected

  up to 0.9.4

  What to do

  Affects up to 0.9.4. Update Solidres – Hotel booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Easy Code Snippets: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-23780 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alpha BPO Easy Code Snippets easy-code-snippets allows SQL Injection.This issue affects Easy Code Snippets: from n/a through <= 1.0.2.

  Product

  Easy Code Snippets

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update Easy Code Snippets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025ResAds: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-23779 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in web-mv ResAds resads allows SQL Injection.This issue affects ResAds: from n/a through <= 2.0.5.

  Product

  ResAds

  Affected

  up to 2.0.5

  What to do

  Affects up to 2.0.5. Update ResAds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 15, 2025Neon Product Designer: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22799 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in vertim Neon Product Designer neon-product-designer-for-woocommerce allows SQL Injection.This issue affects Neon Product Designer: from n/a through <= 2.2.0.

  Product

  Neon Product Designer

  Affected

  up to 2.2.0

  What to do

  Affects up to 2.2.0. Update Neon Product Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 15, 2025Course Booking System: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22785 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ComMotion Course Booking System course-booking-system allows SQL Injection.This issue affects Course Booking System: from n/a through <= 6.0.6.

  Product

  Course Booking System

  Affected

  up to 6.0.6

  What to do

  Affects up to 6.0.6. Update Course Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 9, 2025Virtual Bot: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22542 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ofek Nakar Virtual Bot virtual-bot allows Blind SQL Injection.This issue affects Virtual Bot: from n/a through <= 1.0.0.

  Product

  Virtual Bot

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Virtual Bot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 9, 2025Emailing Subscription: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22540 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in seballero Emailing Subscription email-suscripcion allows Blind SQL Injection.This issue affects Emailing Subscription: from n/a through <= 1.4.1.

  Product

  Emailing Subscription

  Affected

  up to 1.4.1

  What to do

  Affects up to 1.4.1. Update Emailing Subscription to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 9, 2025Google Maps Travel Route: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22537 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in traveller11 Google Maps Travel Route google-maps-travel-route allows SQL Injection.This issue affects Google Maps Travel Route: from n/a through <= 1.3.1.

  Product

  Google Maps Travel Route

  Affected

  up to 1.3.1

  What to do

  Affects up to 1.3.1. Update Google Maps Travel Route to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 9, 2025WPListCal: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22535 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jonkern WPListCal wplistcal allows SQL Injection.This issue affects WPListCal: from n/a through <= 1.3.5.

  Product

  WPListCal

  Affected

  up to 1.3.5

  What to do

  Affects up to 1.3.5. Update WPListCal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 9, 2025Mailing Group Listserv: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22527 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yamna Khawaja Mailing Group Listserv wp-mailing-group allows SQL Injection.This issue affects Mailing Group Listserv: from n/a through <= 2.0.9.

  Product

  Mailing Group Listserv

  Affected

  up to 2.0.9

  What to do

  Affects up to 2.0.9. Update Mailing Group Listserv to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 9, 2025NC Wishlist for Woocommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22505 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crispweb NC Wishlist for Woocommerce nc-wishlist-for-woocommerce allows SQL Injection.This issue affects NC Wishlist for Woocommerce: from n/a through <= 1.0.1.

  Product

  NC Wishlist for Woocommerce

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update NC Wishlist for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Ultimate Learning Pro: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22350 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WpIndeed Ultimate Learning Pro allows SQL Injection.This issue affects Ultimate Learning Pro: from n/a through 3.9.

  Product

  Ultimate Learning Pro

  Affected

  up to 3.9

  What to do

  Affects up to 3.9. Update Ultimate Learning Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025WP Music Player: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22536 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in hiren.sabd WP Music Player wp-music-player allows SQL Injection.This issue affects WP Music Player: from n/a through <= 1.3.

  Product

  WP Music Player

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update WP Music Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025WOOEXIM: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22533 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bulktheme WOOEXIM wooexim allows SQL Injection.This issue affects WOOEXIM: from n/a through <= 5.0.0.

  Product

  WOOEXIM

  Affected

  up to 5.0.0

  What to do

  Affects up to 5.0.0. Update WOOEXIM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025eDoc Easy Tables: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22519 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jerodmoore eDoc Easy Tables edoc-easy-tables allows SQL Injection.This issue affects eDoc Easy Tables: from n/a through <= 1.29.

  Product

  eDoc Easy Tables

  Affected

  up to 1.29

  What to do

  Affects up to 1.29. Update eDoc Easy Tables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025WPMU Prefill Post: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22507 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in iDo8p WPMU Prefill Post wpmu-prefill-post allows SQL Injection.This issue affects WPMU Prefill Post: from n/a through <= 1.02.

  Product

  WPMU Prefill Post

  Affected

  up to 1.02

  What to do

  Affects up to 1.02. Update WPMU Prefill Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025MindValley Super PageMash: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22502 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mindvalley MindValley Super PageMash mindvalley-pagemash allows SQL Injection.This issue affects MindValley Super PageMash: from n/a through <= 1.1.

  Product

  MindValley Super PageMash

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update MindValley Super PageMash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22352 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes elex-bulk-edit-products-prices-attributes-for-woocommerce-basic allows Blind SQL Injection.This issue affects ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes: from n/a through <= 1.4.9.

  Product

  ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes

  Affected

  up to 1.4.9

  What to do

  Affects up to 1.4.9. Update ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Contact Form 7 Database – CFDB7: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22351 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in penguinarts Contact Form 7 Database – CFDB7 advanced-cf7-database allows SQL Injection.This issue affects Contact Form 7 Database – CFDB7: from n/a through <= 1.0.0.

  Product

  Contact Form 7 Database – CFDB7

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Contact Form 7 Database – CFDB7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025WordPress Auction: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22349 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Marka WordPress Auction Plugin wp-auctions allows SQL Injection.This issue affects WordPress Auction Plugin: from n/a through <= 3.7.

  Product

  WordPress Auction

  Affected

  up to 3.7

  What to do

  Affects up to 3.7. Update WordPress Auction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025DynamicTags: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22348 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in rtowebsites DynamicTags dynamictags allows Blind SQL Injection.This issue affects DynamicTags: from n/a through <= 1.4.0.

  Product

  DynamicTags

  Affected

  up to 1.4.0

  What to do

  Affects up to 1.4.0. Update DynamicTags to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Multiple Shipping And Billing Address For Woocommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-56290 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in silverplugins217 Multiple Shipping And Billing Address For Woocommerce different-shipping-and-billing-address-for-woocommerce allows SQL Injection.This issue affects Multiple Shipping And Billing Address For Woocommerce: from n/a through <= 1.2.

  Product

  Multiple Shipping And Billing Address For Woocommerce

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Multiple Shipping And Billing Address For Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025SSL Wireless SMS Notification: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-56284 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in sslplugins SSL Wireless SMS Notification ssl-wireless-sms-notification allows SQL Injection.This issue affects SSL Wireless SMS Notification: from n/a through <= 3.5.0.

  Product

  SSL Wireless SMS Notification

  Affected

  up to 3.5.0

  What to do

  Affects up to 3.5.0. Update SSL Wireless SMS Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025ClickWhale: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51715 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ClickWhale ClickWhale clickwhale allows Blind SQL Injection.This issue affects ClickWhale: from n/a through <= 2.4.1.

  Product

  ClickWhale

  Affected

  up to 2.4.1

  What to do

  Affects up to 2.4.1. Update ClickWhale to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Just Writing Statistics: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-56250 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Greg Ross Just Writing Statistics just-writing-statistics allows SQL Injection.This issue affects Just Writing Statistics: from n/a through <= 4.7.

  Product

  Just Writing Statistics

  Affected

  up to 4.7

  What to do

  Affects up to 4.7. Update Just Writing Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025WP Post Author: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-56247 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AF themes WP Post Author wp-post-author allows SQL Injection.This issue affects WP Post Author: from n/a through <= 3.8.2.

  Product

  WP Post Author

  Affected

  up to 3.8.2

  What to do

  Affects up to 3.8.2. Update WP Post Author to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.