Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,202 results · page 12 of 25
Apr 11, 2025Eazy Plugin Manager: Missing AuthorizationCVE-2025-32542 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in EazyPlugins Eazy Plugin Manager plugins-on-steroids allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eazy Plugin Manager: from n/a through <= 4.3.0.
- Product
- Eazy Plugin Manager
- Affected
- up to 4.3.0
- What to do
- Affects up to 4.3.0. Update Eazy Plugin Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2025Job Board Manager: Deserialization of Untrusted DataCVE-2025-32144 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in PickPlugins Job Board Manager job-board-manager allows Object Injection.This issue affects Job Board Manager: from n/a through <= 2.1.61.
- Product
- Job Board Manager
- Affected
- up to 2.1.61
- What to do
- Affects up to 2.1.61. Update Job Board Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2025AnyTrack Affiliate Link Manager: Missing AuthorizationCVE-2025-31041 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in AnyTrack AnyTrack Affiliate Link Manager anytrack-affiliate-link-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyTrack Affiliate Link Manager: from n/a through <= 1.0.4.
- Product
- AnyTrack Affiliate Link Manager
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update AnyTrack Affiliate Link Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025Real Estate Manager: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32668 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Rameez Iqbal Real Estate Manager real-estate-manager allows PHP Local File Inclusion.This issue affects Real Estate Manager: from n/a through <= 7.3.
- Product
- Real Estate Manager
- Affected
- up to 7.3
- What to do
- Affects up to 7.3. Update Real Estate Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025Simple Post Meta Manager: Cross-Site Request Forgery (CSRF)CVE-2025-32556 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Sandor Kovacs Simple Post Meta Manager simple-post-meta-manager allows Reflected XSS.This issue affects Simple Post Meta Manager: from n/a through <= 1.0.9.
- Product
- Simple Post Meta Manager
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Simple Post Meta Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025Nav Menu Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31017 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robert Noakes Nav Menu Manager noakes-menu-manager allows Stored XSS.This issue affects Nav Menu Manager: from n/a through <= 3.2.5.
- Product
- Nav Menu Manager
- Affected
- up to 3.2.5
- What to do
- Affects up to 3.2.5. Update Nav Menu Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts: Stored Cross-Site ScriptingCVE-2025-3100 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.6.22 due to insufficient input sanitization and output escaping in tasks discussion. This makes it possible for authenticated attackers, with Subscriber-level access and above, and permissions granted by an Administrator, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
- Product
- WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts
- Affected
- up to 2.6.22
- What to do
- Affects up to 2.6.22. Update WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 4, 2025WP Project Manager: Cross-Site Request Forgery (CSRF)CVE-2025-32280 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in weDevs WP Project Manager wedevs-project-manager allows Cross Site Request Forgery.This issue affects WP Project Manager: from n/a through < 2.6.25.
- Product
- WP Project Manager
- Affected
- up to 2.6.22
- What to do
- Affects up to 2.6.22. Update WP Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025WP Event Manager: Missing AuthorizationCVE-2025-32225 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Event Manager WP Event Manager wp-event-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Manager: from n/a through <= 3.2.0.
- Product
- WP Event Manager
- Affected
- up to 3.2.0
- What to do
- Affects up to 3.2.0. Update WP Event Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Real Estate Manager: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32150 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Rameez Iqbal Real Estate Manager real-estate-manager allows PHP Local File Inclusion.This issue affects Real Estate Manager: from n/a through <= 7.3.
- Product
- Real Estate Manager
- Affected
- up to 7.3
- What to do
- Affects up to 7.3. Update Real Estate Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025JS Job Manager: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32146 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in JoomSky JS Job Manager js-jobs allows PHP Local File Inclusion.This issue affects JS Job Manager: from n/a through <= 2.0.2.
- Product
- JS Job Manager
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update JS Job Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Posts Footer Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32130 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Data443 Risk Mitigation, Inc. Posts Footer Manager intelly-posts-footer-manager allows Stored XSS.This issue affects Posts Footer Manager: from n/a through <= 2.2.0.
- Product
- Posts Footer Manager
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update Posts Footer Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Behance Portfolio Manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32124 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in eleopard Behance Portfolio Manager portfolio-manager-powered-by-behance allows Blind SQL Injection.This issue affects Behance Portfolio Manager: from n/a through <= 1.7.5.
- Product
- Behance Portfolio Manager
- Affected
- up to 1.7.5
- What to do
- Affects up to 1.7.5. Update Behance Portfolio Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Sidebar Manager Light: Cross-Site Request Forgery (CSRF)CVE-2025-32112 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in OTWthemes Sidebar Manager Light sidebar-manager-light allows Cross Site Request Forgery.This issue affects Sidebar Manager Light: from n/a through <= 1.18.
- Product
- Sidebar Manager Light
- Affected
- up to 1.18
- What to do
- Affects up to 1.18. Update Sidebar Manager Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2025WR Price List Manager For Woocommerce: Missing AuthorizationCVE-2025-31794 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Web Ready Now WR Price List Manager For Woocommerce wr-price-list-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WR Price List Manager For Woocommerce: from n/a through <= 1.0.8.
- Product
- WR Price List Manager For Woocommerce
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update WR Price List Manager For Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2025Widget Manager Light: Missing AuthorizationCVE-2025-31768 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in OTWthemes Widget Manager Light widget-manager-light allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Widget Manager Light: from n/a through <= 1.18.
- Product
- Widget Manager Light
- Affected
- up to 1.18
- What to do
- Affects up to 1.18. Update Widget Manager Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2025Minimalistic Event Manager: Missing AuthorizationCVE-2025-31739 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Missing Authorization vulnerability in Manuel Schmalstieg Minimalistic Event Manager minimalistic-event-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Minimalistic Event Manager: from n/a through <= 1.1.1.
- Product
- Minimalistic Event Manager
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Minimalistic Event Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Fonts Manager | Custom Fonts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31578 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wisdomlogix Solutions Pvt. Ltd. Fonts Manager | Custom Fonts fonts-manager-custom-fonts allows Reflected XSS.This issue affects Fonts Manager | Custom Fonts: from n/a through <= 1.2.
- Product
- Fonts Manager | Custom Fonts
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Fonts Manager | Custom Fonts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025JS Job Manager: Missing AuthorizationCVE-2025-31868 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in JoomSky JS Job Manager js-jobs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Job Manager: from n/a through <= 2.0.2.
- Product
- JS Job Manager
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update JS Job Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025JS Job Manager: Authorization Bypass Through User-Controlled KeyCVE-2025-31867 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in JoomSky JS Job Manager js-jobs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Job Manager: from n/a through <= 2.0.2.
- Product
- JS Job Manager
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update JS Job Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Job Board Manager: Missing AuthorizationCVE-2025-31862 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in PickPlugins Job Board Manager job-board-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Job Board Manager: from n/a through <= 2.1.61.
- Product
- Job Board Manager
- Affected
- up to 2.1.61
- What to do
- Affects up to 2.1.61. Update Job Board Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Review Manager: Missing AuthorizationCVE-2025-31836 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in matthewrubin Review Manager review-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Review Manager: from n/a through <= 2.5.0.
- Product
- Review Manager
- Affected
- up to 2.5.0
- What to do
- Affects up to 2.5.0. Update Review Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Content Manager Light: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31770 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Content Manager Light content-manager-light allows Stored XSS.This issue affects Content Manager Light: from n/a through <= 3.2.
- Product
- Content Manager Light
- Affected
- up to 3.2
- What to do
- Affects up to 3.2. Update Content Manager Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Mobile DJ Manager: Deserialization of Untrusted DataCVE-2025-31074 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in MDJM Mobile DJ Manager mobile-dj-manager allows Object Injection.This issue affects Mobile DJ Manager: from n/a through <= 1.7.5.2.
- Product
- Mobile DJ Manager
- Affected
- up to 1.7.5.2
- What to do
- Affects up to 1.7.5.2. Update Mobile DJ Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025CM Download Manager: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-30910 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CreativeMindsSolutions CM Download Manager cm-download-manager allows Path Traversal.This issue affects CM Download Manager: from n/a through <= 2.9.6.
- Product
- CM Download Manager
- Affected
- up to 2.9.6
- What to do
- Affects up to 2.9.6. Update CM Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Lana Downloads Manager: Does not validate user input used in a pathCVE-2025-2048 · WordPress plugins & themes · reported by WPScanMedium 4.1
The Lana Downloads Manager WordPress plugin before 1.10.0 does not validate user input used in a path, which could allow users with an admin role to perform path traversal attacks and download arbitrary files on the server
- Product
- Lana Downloads Manager
- Fixed in
- 1.10.0
- What to do
- Update Lana Downloads Manager to 1.10.0 or newer.
Mar 31, 2025CoverManager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31620 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in carperfer CoverManager covermanager allows Stored XSS.This issue affects CoverManager: from n/a through <= 0.0.1.
- Product
- CoverManager
- Affected
- up to 0.0.1
- What to do
- Affects up to 0.0.1. Update CoverManager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025Behance Portfolio Manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31526 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in eleopard Behance Portfolio Manager portfolio-manager-powered-by-behance allows SQL Injection.This issue affects Behance Portfolio Manager: from n/a through <= 1.7.5.
- Product
- Behance Portfolio Manager
- Affected
- up to 1.7.5
- What to do
- Affects up to 1.7.5. Update Behance Portfolio Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2025OmniLeads Scripts and Tags Manager: Cross-Site Request Forgery (CSRF)CVE-2025-31460 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in danielmuldernl OmniLeads Scripts and Tags Manager omnileads-scripts-and-tags-manager allows Stored XSS.This issue affects OmniLeads Scripts and Tags Manager: from n/a through <= 1.3.
- Product
- OmniLeads Scripts and Tags Manager
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update OmniLeads Scripts and Tags Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Job Colors for WP Job Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31031 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Astoundify Job Colors for WP Job Manager wp-job-manager-colors allows Stored XSS.This issue affects Job Colors for WP Job Manager: from n/a through <= 1.0.4.
- Product
- Job Colors for WP Job Manager
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Job Colors for WP Job Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025WP Project Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22649 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs WP Project Manager wedevs-project-manager allows Stored XSS.This issue affects WP Project Manager: from n/a through <= 2.6.22.
- Product
- WP Project Manager
- Affected
- up to 2.6.22
- What to do
- Affects up to 2.6.22. Update WP Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Team Manager: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-30868 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Maidul Team Manager wp-team-manager allows PHP Local File Inclusion.This issue affects Team Manager: from n/a through <= 2.1.23.
- Product
- Team Manager
- Affected
- up to 2.1.23
- What to do
- Affects up to 2.1.23. Update Team Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Custom Field For WP Job Manager: Cross-Site Request Forgery (CSRF)CVE-2025-30856 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in theme funda Custom Field For WP Job Manager custom-field-for-wp-job-manager allows Cross Site Request Forgery.This issue affects Custom Field For WP Job Manager: from n/a through <= 1.4.
- Product
- Custom Field For WP Job Manager
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Custom Field For WP Job Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Taxi Booking Manager for WooCommerce: Missing AuthorizationCVE-2025-30839 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in magepeopleteam Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Taxi Booking Manager for WooCommerce: from n/a through <= 1.2.1.
- Product
- Taxi Booking Manager for WooCommerce
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Taxi Booking Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Chatbox Manager: Missing AuthorizationCVE-2025-30790 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in alexvtn Chatbox Manager wa-chatbox-manager allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Chatbox Manager: from n/a through <= 1.2.2.
- Product
- Chatbox Manager
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Chatbox Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 26, 2025WP Google Calendar Manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-28939 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in EuroCizia WP Google Calendar Manager wp-gcalendar allows Blind SQL Injection.This issue affects WP Google Calendar Manager: from n/a through <= 2.1.
- Product
- WP Google Calendar Manager
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update WP Google Calendar Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 26, 2025BWL Advanced FAQ Manager: Unauthorized modification of data that can lead to a denial of serviceCVE-2024-13801 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The BWL Advanced FAQ Manager plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'baf_set_notice_status' AJAX action in all versions up to, and including, 2.1.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to '1' on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny service to legitimate users or be used to set some values to true such as registration.
- Product
- BWL Advanced FAQ Manager
- Affected
- up to 2.1.4
- What to do
- Affects up to 2.1.4. Update BWL Advanced FAQ Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Mar 25, 2025Digital License Manager: Reflected Cross-Site ScriptingCVE-2025-2635 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Digital License Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg() function without appropriate escaping on the URL in all versions up to, and including, 1.7.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Digital License Manager
- Affected
- up to 1.7.3
- What to do
- Affects up to 1.7.3. Update Digital License Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 24, 2025banner-manager: Cross-Site Request Forgery (CSRF)CVE-2025-30565 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in karrikas banner-manager banner-manager allows Stored XSS.This issue affects banner-manager: from n/a through <= 16.04.19.
- Product
- banner-manager
- Affected
- up to 16.04.19
- What to do
- Affects up to 16.04.19. Update banner-manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 20, 2025Event Manager, Events Calendar, Tickets, Registrations – Eventin: Local File InclusionCVE-2025-1770 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.0.24 via the 'style' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
- Product
- Event Manager, Events Calendar, Tickets, Registrations – Eventin
- Affected
- up to 4.0.24
- What to do
- Affects up to 4.0.24. Update Event Manager, Events Calendar, Tickets, Registrations – Eventin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 20, 2025Event Manager, Events Calendar, Tickets, Registrations – Eventin: Unauthorized modification of dataCVE-2025-1766 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'payment_complete' function in all versions up to, and including, 4.0.24. This makes it possible for unauthenticated attackers to update the status of ticket payments to 'completed', possibly resulting in financial loss.
- Product
- Event Manager, Events Calendar, Tickets, Registrations – Eventin
- Affected
- up to 4.0.24
- What to do
- Affects up to 4.0.24. Update Event Manager, Events Calendar, Tickets, Registrations – Eventin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 20, 2025WP-PManager: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13875 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WP-PManager WordPress plugin through 1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- WP-PManager
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update WP-PManager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 16, 2025Download Manager: Doesn't prevent directory listing on web servers that don't use htaccessCVE-2024-13126 · WordPress plugins & themes · reported by WPScanMedium 4.6
The Download Manager WordPress plugin before 3.3.07 doesn't prevent directory listing on web servers that don't use htaccess, allowing unauthorized access of files.
- Product
- Download Manager
- Fixed in
- 3.3.07
- What to do
- Update Download Manager to 3.3.07 or newer.
Mar 15, 2025Booking and Rental Manager: Deserialization of Untrusted DataCVE-2025-26921 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Object Injection.This issue affects Booking and Rental Manager: from n/a through <= 2.2.6.
- Product
- Booking and Rental Manager
- Affected
- up to 2.2.6
- What to do
- Affects up to 2.2.6. Update Booking and Rental Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2025Download Manager: Directory TraversalCVE-2025-1785 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Download Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.08 via the 'wpdm_newfile' action. This makes it possible for authenticated attackers, with Author-level access and above, to overwrite select file types outside of the originally intended directory, which may cause a denial of service.
- Product
- Download Manager
- Affected
- up to 3.3.08
- What to do
- Affects up to 3.3.08. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 11, 2025DP ALTerminator - Missing ALT manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28943 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mylo2h2s DP ALTerminator - Missing ALT manager dp-alterminator-missing-alt-manager allows Stored XSS.This issue affects DP ALTerminator - Missing ALT manager: from n/a through <= 1.0.2.
- Product
- DP ALTerminator - Missing ALT manager
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update DP ALTerminator - Missing ALT manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 7, 2025Post Meta Data Manager: Multisite privilege escalationCVE-2024-13835 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Post Meta Data Manager plugin for WordPress is vulnerable to multisite privilege escalation in all versions up to, and including, 1.4.4. This is due to the plugin not properly verifying the existence of a multisite installation prior to allowing user meta to be added/modified. This makes it possible for authenticated attackers, with Administrator-level access and above, to gain elevated privileges on subsites that would otherwise be inaccessible.
- Product
- Post Meta Data Manager
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update Post Meta Data Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Mar 7, 2025Advanced File Manager — Ultimate WordPress File Manager and Document Library: Stored Cross-Site ScriptingCVE-2024-13805 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Advanced File Manager — Ultimate WordPress File Manager and Document Library Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 5.2.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an Administrator, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
- Product
- Advanced File Manager — Ultimate WordPress File Manager and Document Library
- Affected
- up to 5.2.14
- What to do
- Affects up to 5.2.14. Update Advanced File Manager — Ultimate WordPress File Manager and Document Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 7, 2025Eventer - WordPress Event & Booking Manager: SQL InjectionCVE-2025-0959 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Eventer - WordPress Event & Booking Manager Plugin plugin for WordPress is vulnerable to SQL Injection via the reg_id parameter in all versions up to, and including, 3.9.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Eventer - WordPress Event & Booking Manager
- Affected
- up to 3.9.9.2
- What to do
- Affects up to 3.9.9.2. Update Eventer - WordPress Event & Booking Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Mar 6, 2025Ad Inserter - Ad Manager and AdSense Ads 2.8.0 was found to be vulnerable.CVE-2025-22623 · WordPress plugins & themes · reported by help@fluidattacks.comMedium 5.1
Ad Inserter - Ad Manager and AdSense Ads 2.8.0 was found to be vulnerable. The web application dynamically generates web content without validating the source of the potentially untrusted data in myapp/includes/dst/dst.php.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordfluidattacks.comwordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.