Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

544new WordPress flaws this week

391,181entries in the database

1,454 results · page 13 of 30

Oct 24, 2025Originality.ai AI Checker: Unauthorized access of dataCVE-2025-10901 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Originality.ai AI Checker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'ai_get_table' function in all versions up to, and including, 1.0.16. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read all data in the wp_originalityai_log database table, which can include post titles, scan scores, credits used, and other data.
Product
Originality.ai AI Checker
Affected
up to 1.0.16
What to do
Affects up to 1.0.16. Update Originality.ai AI Checker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 22, 2025Simple Stripe Checkout: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49963 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in growniche Simple Stripe Checkout simple-stripe-checkout allows Reflected XSS.This issue affects Simple Stripe Checkout: from n/a through <= 1.1.28.
Product
Simple Stripe Checkout
Affected
up to 1.1.28
What to do
Affects up to 1.1.28. Update Simple Stripe Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Breeze Checkout: Missing AuthorizationCVE-2025-49961 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Breeze Team Breeze Checkout breeze-checkout allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Breeze Checkout: from n/a through <= 1.4.0.
Product
Breeze Checkout
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update Breeze Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2025SmartCrawl SEO checker, analyzer & optimizer: Unauthorized modification of dataCVE-2025-11163 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The SmartCrawl SEO checker, analyzer & optimizer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_submodule() function in all versions up to, and including, 3.14.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's setttings.
Product
SmartCrawl SEO checker, analyzer & optimizer
Affected
up to 3.14.3
What to do
Affects up to 3.14.3. Update SmartCrawl SEO checker, analyzer & optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 22, 2025AgreeMe Checkboxes For WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-57905 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Amin Y AgreeMe Checkboxes For WooCommerce agreeme-checkboxes-for-woocommerce allows Cross Site Request Forgery.This issue affects AgreeMe Checkboxes For WooCommerce: from n/a through <= 1.1.3.
Product
AgreeMe Checkboxes For WooCommerce
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update AgreeMe Checkboxes For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025WooCommerce Additional Fees On Checkout (Free): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57903 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPSuperiors Developer WooCommerce Additional Fees On Checkout (Free) woo-additional-fees-on-checkout-wordpress allows Stored XSS.This issue affects WooCommerce Additional Fees On Checkout (Free): from n/a through <= 1.5.2.
Product
WooCommerce Additional Fees On Checkout (Free)
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update WooCommerce Additional Fees On Checkout (Free) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 10, 2025Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net: Time-based SQL InjectionCVE-2025-9463 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_by’ parameter in all versions up to, and including, 1.117.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net
Affected
up to 1.117.5
What to do
Affects up to 1.117.5. Update Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 9, 2025Accessibility Checker by Equalize Digital: Missing AuthorizationCVE-2025-58981 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Equalize Digital Accessibility Checker by Equalize Digital accessibility-checker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility Checker by Equalize Digital: from n/a through <= 1.31.0.
Product
Accessibility Checker by Equalize Digital
Affected
up to 1.31.0
What to do
Affects up to 1.31.0. Update Accessibility Checker by Equalize Digital to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 9, 2025Accessibility Checker by Equalize Digital: Missing AuthorizationCVE-2025-58976 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Equalize Digital Accessibility Checker by Equalize Digital accessibility-checker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility Checker by Equalize Digital: from n/a through <= 1.31.0.
Product
Accessibility Checker by Equalize Digital
Affected
up to 1.31.0
What to do
Affects up to 1.31.0. Update Accessibility Checker by Equalize Digital to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 5, 2025WooCommerce Single Page Checkout: Cross-Site Request Forgery (CSRF)CVE-2025-58804 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in brijrajs WooCommerce Single Page Checkout woo-single-page-checkout allows Cross Site Request Forgery.This issue affects WooCommerce Single Page Checkout: from n/a through <= 1.2.7.
Product
WooCommerce Single Page Checkout
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update WooCommerce Single Page Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 5, 2025Custom WooCommerce Checkout Fields Editor: Cross-Site Request Forgery (CSRF)CVE-2025-58799 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in themelocation Custom WooCommerce Checkout Fields Editor add-fields-to-checkout-page-woocommerce allows Cross Site Request Forgery.This issue affects Custom WooCommerce Checkout Fields Editor: from n/a through <= 1.3.4.
Product
Custom WooCommerce Checkout Fields Editor
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update Custom WooCommerce Checkout Fields Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 5, 2025Payoneer Checkout: Missing AuthorizationCVE-2025-58795 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Payoneer Checkout Payoneer Checkout payoneer-checkout allows Content Spoofing.This issue affects Payoneer Checkout: from n/a through <= 3.4.0.
Product
Payoneer Checkout
Affected
up to 3.4.0
What to do
Affects up to 3.4.0. Update Payoneer Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 5, 2025OceanWP: Is vulnerable to an option update due to a missing capability check on one of its AJAX request handlerCVE-2025-8944 · WordPress plugins & themes · reported by WPScanMedium 4.3
The OceanWP WordPress theme before 4.1.2 is vulnerable to an option update due to a missing capability check on one of its AJAX request handler, allowing any authenticated users, such as subscriber to update the darkMod` setting.
Product
OceanWP
Fixed in
4.1.2
What to do
Update OceanWP to 4.1.2 or newer.
Full record and what to do →NVD record wpscan.com
Aug 28, 2025Multiple plugins and/or themes for WordPress by LiquidThemes are vulnerable to unauthorized access due to a missing capability check on the liquid_reset_wordpreCVE-2025-0951 · WordPress plugins & themes · reported by WordfenceMedium 4.3
Multiple plugins and/or themes for WordPress by LiquidThemes are vulnerable to unauthorized access due to a missing capability check on the liquid_reset_wordpress_before AJAX in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to deactivate all of a site's plugins. While we escalated this to Envato after not being able to establish contact, it appears the developer added a nonce check, however that is not sufficient protection as the nonce is exposed to all users with access to the dashboard.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record themeforest.net wordfence.com
Aug 23, 2025Simpler Checkout: Authentication BypassCVE-2025-7642 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Simpler Checkout plugin for WordPress is vulnerable to Authentication Bypass in versions 0.7.0 to 1.1.9. This is due to the plugin not properly verifying a user's identity prior to logging them in as an admin through the simplerwc_woocommerce_order_created() function. This makes it possible for unauthenticated attackers to log in as other users based on their order ID, which can be an administrator if a site admin has placed a test order.
Product
Simpler Checkout
Affected
0.7.0 to 1.1.9
What to do
Affects 0.7.0 to 1.1.9. Update Simpler Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 22, 2025Accessibility Checker by Equalize Digital: Authorization Bypass Through User-Controlled KeyCVE-2025-57886 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in Equalize Digital Accessibility Checker by Equalize Digital accessibility-checker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility Checker by Equalize Digital: from n/a through <= 1.30.0.
Product
Accessibility Checker by Equalize Digital
Affected
up to 1.30.0
What to do
Affects up to 1.30.0. Update Accessibility Checker by Equalize Digital to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 16, 2025LatestCheckins: Cross-Site Request ForgeryCVE-2025-7683 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The LatestCheckins plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1. This is due to missing or incorrect nonce validation on the 'LatestCheckins' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
LatestCheckins
Affected
up to 1
What to do
Affects up to 1. Update LatestCheckins to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 14, 2025myCred: Time-of-check Time-of-use (TOCTOU) Race ConditionCVE-2025-54667 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Saad Iqbal myCred mycred allows Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions.This issue affects myCred: from n/a through <= 2.9.4.3.
Product
myCred
Affected
up to 2.9.4.3
What to do
Affects up to 2.9.4.3. Update myCred to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025Quiz and Survey Master (QSM): Does not have CSRF check in placeCVE-2025-6790 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Quiz and Survey Master (QSM) WordPress plugin before 10.2.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
Product
Quiz and Survey Master (QSM)
Fixed in
10.2.3
What to do
Update Quiz and Survey Master (QSM) to 10.2.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 11, 2025CBX Restaurant Booking: Does not have CSRF check in placeCVE-2025-7965 · WordPress plugins & themes · reported by WPScanMedium 4.3
The CBX Restaurant Booking WordPress plugin through 1.2.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
CBX Restaurant Booking
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update CBX Restaurant Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jul 4, 2025bSecure – Your Universal Checkout: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-52830 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bSecure – Your Universal Checkout bSecure – Your Universal Checkout bsecure allows Blind SQL Injection.This issue affects bSecure – Your Universal Checkout: from n/a through <= 1.7.9.
Product
bSecure – Your Universal Checkout
Affected
up to 1.7.9
What to do
Affects up to 1.7.9. Update bSecure – Your Universal Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 3, 2025DocCheck Login: Unauthorized post accessCVE-2025-6786 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The DocCheck Login plugin for WordPress is vulnerable to unauthorized post access in all versions up to, and including, 1.1.5. This is due to plugin redirecting a user to login on a password protected post after the page has loaded. This makes it possible for unauthenticated attackers to read posts they should not have access to.
Product
DocCheck Login
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update DocCheck Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jun 27, 2025Pre-Publish Post Checklist: Missing AuthorizationCVE-2025-53323 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in danbriapps Pre-Publish Post Checklist pre-publish-post-checklist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pre-Publish Post Checklist: from n/a through <= 3.1.
Product
Pre-Publish Post Checklist
Affected
up to 3.1
What to do
Affects up to 3.1. Update Pre-Publish Post Checklist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily: Missing AuthorizationCVE-2025-50008 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in cscode WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily innovs-woo-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily: from n/a through <= 1.2.4.5.
Product
WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily
Affected
up to 1.2.4.5
What to do
Affects up to 1.2.4.5. Update WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025YITH PayPal Express Checkout for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-48111 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in YITHEMES YITH PayPal Express Checkout for WooCommerce allows Cross Site Request Forgery. This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.49.0.
Product
YITH PayPal Express Checkout for WooCommerce
Affected
up to 1.49.0
What to do
Affects up to 1.49.0. Update YITH PayPal Express Checkout for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 6, 2025Direct Checkout for WooCommerce Lite: Missing AuthorizationCVE-2025-29006 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in centangle Direct Checkout for WooCommerce Lite woo-direct-checkout-lite allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Direct Checkout for WooCommerce Lite: from n/a through <= 1.0.3.
Product
Direct Checkout for WooCommerce Lite
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Direct Checkout for WooCommerce Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 6, 2025BM Content Builder: Unauthorized modification of data to a missing capability check on the 'ux_cb_page_options_save' functionCVE-2025-1777 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The BM Content Builder plugin for WordPress is vulnerable to unauthorized modification of data to a missing capability check on the 'ux_cb_page_options_save' function in all versions up to, and including, 3.16.2.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
BM Content Builder
Affected
up to 3.16.2.1
What to do
Affects up to 3.16.2.1. Update BM Content Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record seatheme.net wordfence.com
Jun 4, 2025File Provider: Does not have CSRF check in placeCVE-2025-4580 · WordPress plugins & themes · reported by WPScanMedium 4.3
The File Provider WordPress plugin through 1.2.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
File Provider
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update File Provider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jun 2, 2025Broken Link Checker: Unauthorized data accessCVE-2025-4047 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Broken Link Checker plugin for WordPress is vulnerable to unauthorized data access due to a missing capability check on the ajax_full_status and ajax_dashboard_status functions in all versions up to, and including, 2.4.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view the plugin's status.
Product
Broken Link Checker
Affected
up to 2.4.4
What to do
Affects up to 2.4.4. Update Broken Link Checker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 19, 2025CheckBot: Cross-Site Request Forgery (CSRF)CVE-2025-43840 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in ref CheckBot checkbot allows Stored XSS.This issue affects CheckBot: from n/a through <= 1.05.
Product
CheckBot
Affected
up to 1.05
What to do
Affects up to 1.05. Update CheckBot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025Wholesale Market WordPress plugin before 2.2.2, Wholesale Market for WooCommerce: Have a flawed CSRF checkCVE-2022-4363 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Wholesale Market WordPress plugin before 2.2.2, Wholesale Market for WooCommerce WordPress plugin before 2.0.1 have a flawed CSRF check when updating their settings, which could allow attackers to make a logged in admin update them via a CSRF attack
Product
Wholesale Market WordPress plugin before 2.2.2, Wholesale Market for WooCommerce
Fixed in
2.2.2
What to do
Update Wholesale Market WordPress plugin before 2.2.2, Wholesale Market for WooCommerce to 2.2.2 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025WP-PManager: Does not have CSRF check in placeCVE-2025-2247 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP-PManager WordPress plugin through 1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
WP-PManager
Affected
up to 1.2
What to do
Affects up to 1.2. Update WP-PManager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
May 15, 2025WOOEXIM: Does not have CSRF check in some placesCVE-2025-1288 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WOOEXIM WordPress plugin through 5.0.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make an unauthenticated user vulnerable to reflected XSS via a CSRF attack.
Product
WOOEXIM
Affected
up to 5.0.0
What to do
Affects up to 5.0.0. Update WOOEXIM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025EKC Tournament Manager: Does not have CSRF check in placeCVE-2024-9711 · WordPress plugins & themes · reported by WPScanMedium 5.4
The EKC Tournament Manager WordPress plugin before 2.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
EKC Tournament Manager
Fixed in
2.2.2
What to do
Update EKC Tournament Manager to 2.2.2 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025EKC Tournament Manager: Does not have CSRF check in placeCVE-2024-9709 · WordPress plugins & themes · reported by WPScanMedium 5.4
The EKC Tournament Manager WordPress plugin before 2.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
EKC Tournament Manager
Fixed in
2.2.2
What to do
Update EKC Tournament Manager to 2.2.2 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Free Booking Plugin for Hotels, Restaurants and Car Rentals: Does not have CSRF check in placeCVE-2024-9450 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Free Booking Plugin for Hotels, Restaurants and Car Rentals WordPress plugin before 1.3.15 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in subscriber change them via a CSRF attack
Product
Free Booking Plugin for Hotels, Restaurants and Car Rentals
Fixed in
1.3.15
What to do
Update Free Booking Plugin for Hotels, Restaurants and Car Rentals to 1.3.15 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Logo Slider: Does not have CSRF check in placeCVE-2024-9233 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Logo Slider WordPress plugin before 3.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
Logo Slider
Fixed in
3.7.1
What to do
Update Logo Slider to 3.7.1 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Event Calendar: Does not check for authorization on delete actionsCVE-2024-8700 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Event Calendar WordPress plugin through 1.0.4 does not check for authorization on delete actions, allowing unauthenticated users to delete arbitrary calendars.
Product
Event Calendar
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Event Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Simple Nav Archives: Does not have CSRF check in placeCVE-2024-8398 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Simple Nav Archives WordPress plugin through 2.1.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
Simple Nav Archives
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update Simple Nav Archives to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
May 15, 2025webtoffee-gdpr-cookie-consent: Does not have CSRF checks in some bulk actionsCVE-2024-8286 · WordPress plugins & themes · reported by WPScanMedium 6.5
The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting visit logs via CSRF attacks
Product
webtoffee-gdpr-cookie-consent
Fixed in
2.6.1
What to do
Update webtoffee-gdpr-cookie-consent to 2.6.1 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025GamiPress: Does not have CSRF check in placeCVE-2024-8245 · WordPress plugins & themes · reported by WPScanMedium 4.3
The GamiPress WordPress plugin before 1.0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
GamiPress
Fixed in
1.0.1
What to do
Update GamiPress to 1.0.1 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025BabelZ: Does not have CSRF check in some placesCVE-2024-8095 · WordPress plugins & themes · reported by WPScanMedium 6.1
The BabelZ WordPress plugin through 1.1.5 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
Product
BabelZ
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update BabelZ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Ntz Antispam: Does not have CSRF check in placeCVE-2024-8094 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Ntz Antispam WordPress plugin through 2.0e does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
Ntz Antispam
Affected
up to 2.0e
What to do
Affects up to 2.0e. Update Ntz Antispam to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025JavaScript Logic: Does not have CSRF check in some placesCVE-2024-8090 · WordPress plugins & themes · reported by WPScanMedium 6.1
The JavaScript Logic WordPress plugin through 0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
Product
JavaScript Logic
Affected
up to 0.1
What to do
Affects up to 0.1. Update JavaScript Logic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025PeoplePond: Does not have CSRF check in some placesCVE-2024-8085 · WordPress plugins & themes · reported by WPScanMedium 6.1
The PeoplePond WordPress plugin through 1.1.9 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
Product
PeoplePond
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update PeoplePond to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Widgets Reset: Does not have CSRF check in placeCVE-2024-8082 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Widgets Reset WordPress plugin through 0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
Widgets Reset
Affected
up to 0.1
What to do
Affects up to 0.1. Update Widgets Reset to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Custom Author Base: Does not have CSRF check in placeCVE-2024-8050 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Custom Author Base WordPress plugin through 1.1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
Custom Author Base
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Custom Author Base to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Smooth Gallery Replacement: Does not have CSRF check in some placesCVE-2024-8032 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Smooth Gallery Replacement WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
Product
Smooth Gallery Replacement
Affected
up to 1.0
What to do
Affects up to 1.0. Update Smooth Gallery Replacement to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Joy Of Text Lite: Does not have CSRF check in placeCVE-2024-7984 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Joy Of Text Lite WordPress plugin through 2.3.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
Joy Of Text Lite
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update Joy Of Text Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
May 15, 2025Offload Videos: Does not have CSRF check in placeCVE-2024-6719 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Offload Videos WordPress plugin before 1.0.1 does not have CSRF check in place when updating its settings, which could allow low privilege users to update them via a CSRF attack
Product
Offload Videos
Fixed in
1.0.1
What to do
Update Offload Videos to 1.0.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.