Updated 13 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

37added in the last 30 days

544new WordPress flaws this week

391,181entries in the database

1,593 results · page 13 of 32

Aug 14, 2025Product XML Feed Manager for WooCommerce: Improper Control of Generation of Code ('Code Injection')CVE-2025-49887 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Control of Generation of Code ('Code Injection') vulnerability in WPFactory Product XML Feed Manager for WooCommerce product-xml-feeds-for-woocommerce allows Remote Code Inclusion.This issue affects Product XML Feed Manager for WooCommerce: from n/a through <= 2.9.3.
Product
Product XML Feed Manager for WooCommerce
Affected
up to 2.9.3
What to do
Affects up to 2.9.3. Update Product XML Feed Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025WP Airdrop Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49053 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kadesthemes WP Airdrop Manager airdrop allows Stored XSS.This issue affects WP Airdrop Manager: from n/a through <= 1.0.5.
Product
WP Airdrop Manager
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update WP Airdrop Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2025Easy restaurant menu manager: Cross-Site Request ForgeryCVE-2025-8491 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Easy restaurant menu manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on the nsc_eprm_save_menu() function. This makes it possible for unauthenticated attackers to upload a menu file via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Easy restaurant menu manager
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update Easy restaurant menu manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 12, 2025Software Issue Manager: Stored Cross-Site ScriptingCVE-2025-8314 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Software Issue Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg parameter in all versions up to, and including, 5.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Software Issue Manager
Affected
up to 5.0.1
What to do
Affects up to 5.0.1. Update Software Issue Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Aug 5, 2025FileBird – WordPress Media Library Folders & File Manager: SQL InjectionCVE-2025-6986 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to SQL Injection via the 'search' parameter in all versions up to, and including, 6.4.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
FileBird – WordPress Media Library Folders & File Manager
Affected
up to 6.4.8
What to do
Affects up to 6.4.8. Update FileBird – WordPress Media Library Folders & File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 5, 2025upload.php: The WordPress plugin Asset-Manager version 2.0 and below contains an unauthenticated arbitrary file uploadCVE-2012-10026 · WordPress plugins & themes · reported by VulnCheckCritical 10
The WordPress plugin Asset-Manager version 2.0 and below contains an unauthenticated arbitrary file upload vulnerability in upload.php. The endpoint fails to properly validate and restrict uploaded file types, allowing remote attackers to upload malicious PHP scripts to a predictable temporary directory. Once uploaded, the attacker can execute the file via a direct HTTP GET request, resulting in remote code execution under the web server’s context.
Product
upload.php
What to do
Update upload.php to the newest version.
Full record and what to do →NVD record web.archive.org raw.githubusercontent.com
Aug 1, 2025IDonate – Blood Donation, Request And Donor Management System: Unauthorized access of dataCVE-2025-4523 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the admin_donor_profile_view() function in versions 2.0.0 to 2.1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to expose an administrator’s username, email address, and all donor fields.
Product
IDonate – Blood Donation, Request And Donor Management System
Affected
2.0.0 to 2.1.9
What to do
Affects 2.0.0 to 2.1.9. Update IDonate – Blood Donation, Request And Donor Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 25, 2025Frontend File Manager: Unauthorized loss of dataCVE-2023-7306 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Frontend File Manager Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the wpfm_delete_multiple_files() function in all versions up to, and including, 21.5. This makes it possible for unauthenticated attackers to delete arbitrary posts.
Product
Frontend File Manager
Affected
up to 21.5
What to do
Affects up to 21.5. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 22, 2025Fleetwire Fleet Management: Stored Cross-Site ScriptingCVE-2025-6261 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Fleetwire Fleet Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's fleetwire_list shortcode in all versions up to, and including, 1.0.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Fleetwire Fleet Management
Affected
up to 1.0.19
What to do
Affects up to 1.0.19. Update Fleetwire Fleet Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jul 21, 2025CRM and Lead Management by vcita: Stored Cross-Site ScriptingCVE-2025-5240 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘type’ parameter in all versions up to, and including, 2.7.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
CRM and Lead Management by vcita
Affected
up to 2.7.5
What to do
Affects up to 2.7.5. Update CRM and Lead Management by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 18, 2025Attachment Manager: Arbitrary file deletionCVE-2025-7643 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Attachment Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the handle_actions() function in all versions up to, and including, 2.1.2. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
Attachment Manager
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Attachment Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jul 18, 2025WooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet: Arbitrary file uploadsCVE-2025-6222 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'ced_rnx_order_exchange_attach_files' function in all versions up to, and including, 3.2.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
WooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet
Affected
up to 3.2.6
What to do
Affects up to 3.2.6. Update WooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jul 18, 2025School Management System for: Local File InclusionCVE-2025-3740 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The School Management System for Wordpress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 93.1.0 via the 'page' parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. The Local File Inclusion exploit can be chained to include various dashboard view files in the plugin. One such chain can be leveraged to update the password of Super Administrator accounts in Multisite environments making privilege escalation possible. The vendor has updated the version numbers beginning with `1.93.1 (02-07-2025)` for the patched version. This version comes after version 93.1.0.
Product
School Management System for
Affected
up to 93.1.0
What to do
Affects up to 93.1.0. Update School Management System for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jul 16, 2025Product XML Feed Manager for WooCommerce: Missing AuthorizationCVE-2025-30959 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WPFactory Product XML Feed Manager for WooCommerce product-xml-feeds-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product XML Feed Manager for WooCommerce: from n/a through <= 2.9.2.
Product
Product XML Feed Manager for WooCommerce
Affected
up to 2.9.2
What to do
Affects up to 2.9.2. Update Product XML Feed Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025Chatbox Manager: Missing AuthorizationCVE-2025-48167 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in alexvtn Chatbox Manager wa-chatbox-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Chatbox Manager: from n/a through <= 1.2.5.
Product
Chatbox Manager
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update Chatbox Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce: Stored Cross-Site ScriptingCVE-2025-2800 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘organizer_name' parameter in all versions up to, and including, 3.1.50 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce
Affected
up to 3.1.50
What to do
Affects up to 3.1.50. Update WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 16, 2025WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce: Stored Cross-Site ScriptingCVE-2025-2799 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tag-name’ parameter in all versions up to, and including, 3.1.49 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce
Affected
up to 3.1.49
What to do
Affects up to 3.1.49. Update WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 11, 2025WPGYM - Wordpress Gym Management System: SQL InjectionCVE-2025-7442 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to SQL Injection via several parameters in the MJ_gmgt_delete_class_limit_for_member, MJ_gmgt_get_yearly_income_expense, MJ_gmgt_get_monthly_income_expense, MJ_gmgt_add_class_limit, MJ_gmgt_view_meeting_detail, and MJ_gmgt_create_meeting functions in all versions up to 67.8.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WPGYM - Wordpress Gym Management System
Affected
up to 67.8.0
What to do
Affects up to 67.8.0. Update WPGYM - Wordpress Gym Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jul 10, 2025Lana Downloads Manager: Stored Cross-Site ScriptingCVE-2025-7387 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Lana Downloads Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the endpoint parameters in versions up to, and including, 1.10.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with administrator-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Lana Downloads Manager
Affected
up to 1.10.0
What to do
Affects up to 1.10.0. Update Lana Downloads Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2025Events Manager – Calendar, Bookings, Tickets, and more!: Stored Cross-Site ScriptingCVE-2025-6976 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 7.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Events Manager – Calendar, Bookings, Tickets, and more!
Affected
up to 7.0.3
What to do
Affects up to 7.0.3. Update Events Manager – Calendar, Bookings, Tickets, and more! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2025Events Manager – Calendar, Bookings, Tickets, and more!: Reflected Cross-Site ScriptingCVE-2025-6975 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘calendar_header’ parameter in all versions up to, and including, 7.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Events Manager – Calendar, Bookings, Tickets, and more!
Affected
up to 7.0.3
What to do
Affects up to 7.0.3. Update Events Manager – Calendar, Bookings, Tickets, and more! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2025Events Manager – Calendar, Bookings, Tickets, and more!: Time-based SQL InjectionCVE-2025-6970 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 7.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Events Manager – Calendar, Bookings, Tickets, and more!
Affected
up to 7.0.3
What to do
Affects up to 7.0.3. Update Events Manager – Calendar, Bookings, Tickets, and more! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 8, 2025WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible: Unauthorized modification of dataCVE-2025-3780 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wcfm_redirect_to_setup function in all versions up to, and including, 6.7.16. This makes it possible for unauthenticated attackers to view and modify the plugin settings, including payment details and API keys
Product
WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible
Affected
up to 6.7.16
What to do
Affects up to 6.7.16. Update WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 4, 2025Video List Manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-52831 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in thanhtungtnt Video List Manager video-list-manager allows SQL Injection.This issue affects Video List Manager: from n/a through <= 1.7.
Product
Video List Manager
Affected
up to 1.7
What to do
Affects up to 1.7. Update Video List Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 4, 2025Video List Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52776 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thanhtungtnt Video List Manager video-list-manager allows Stored XSS.This issue affects Video List Manager: from n/a through <= 1.7.
Product
Video List Manager
Affected
up to 1.7
What to do
Affects up to 1.7. Update Video List Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 4, 2025Content Manager Light: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24771 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Content Manager Light content-manager-light allows Reflected XSS.This issue affects Content Manager Light: from n/a through <= 3.2.
Product
Content Manager Light
Affected
up to 3.2
What to do
Affects up to 3.2. Update Content Manager Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 4, 2025Frontend File Manager: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2025-27358 · WordPress plugins & themes · reported by PatchstackMedium 4.6
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in N-Media Frontend File Manager nmedia-user-file-uploader allows Code Injection.This issue affects Frontend File Manager: from n/a through <= 23.6.
Product
Frontend File Manager
Affected
up to 23.6
What to do
Affects up to 23.6. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 4, 2025Easy restaurant menu manager: Stored Cross-Site ScriptingCVE-2025-6673 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Easy restaurant menu manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's nsc_eprm_menu_link shortcode in versions up to, and including 2.0.1, due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Easy restaurant menu manager
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Easy restaurant menu manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 3, 2025WP Human Resource Management: Arbitrary User DeletionCVE-2025-5956 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Human Resource Management plugin for WordPress is vulnerable to Arbitrary User Deletion due to a missing authorization within the ajax_delete_employee() function in versions 2.0.0 through 2.2.17. The plugin’s deletion handler reads the client-supplied $_POST['delete'] array and passes each ID directly to wp_delete_user() without verifying that the caller has the delete_users capability or limiting which user IDs may be removed. This makes it possible for authenticated attackers, with Employee-level access and above, to delete arbitrary accounts, including administrators.
Product
WP Human Resource Management
Affected
up to 2.2.17
What to do
Affects up to 2.2.17. Update WP Human Resource Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jul 3, 2025WP Human Resource Management: Privilege EscalationCVE-2025-5953 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Human Resource Management plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization in the ajax_insert_employee() and update_empoyee() functions in versions 2.0.0 through 2.2.17. The AJAX handler reads the client-supplied $_POST['role'] and, after basic cleaning via hrm_clean(), passes it directly to wp_insert_user() and later to $user->set_role() without verifying that the current user is allowed to assign that role. This makes it possible for authenticated attackers, with Employee-level access and above, to elevate their privileges to administrator.
Product
WP Human Resource Management
Affected
up to 2.2.17
What to do
Affects up to 2.2.17. Update WP Human Resource Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 3, 2025VikRentCar Car Rental Management System: Arbitrary file uploadsCVE-2025-5322 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the do_updatecar and createcar functions in all versions up to, and including, 1.4.3. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server, which may make remote code execution possible.
Product
VikRentCar Car Rental Management System
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update VikRentCar Car Rental Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 2, 2025Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager: Cross-Site Request ForgeryCVE-2025-6459 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.89. This is due to missing or incorrect nonce validation on the bsaCreateAdTemplate function. This makes it possible for unauthenticated attackers to inject and execute arbitrary PHP code via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager
Affected
up to 4.89
What to do
Affects up to 4.89. Update Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jul 2, 2025Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager: SQL InjectionCVE-2025-6437 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to SQL Injection via the ‘oid’ parameter in all versions up to, and including, 4.89 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager
Affected
up to 4.89
What to do
Affects up to 4.89. Update Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jul 2, 2025Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager: Time-based SQL InjectionCVE-2025-5339 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘bsa_pro_id’ parameter in all versions up to, and including, 4.89 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager
Affected
up to 4.89
What to do
Affects up to 4.89. Update Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record localhost wordfence.com
Jul 2, 2025Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager: Local File Inclusion which leads to Remote Code ExecutionCVE-2025-4689 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion which leads to Remote Code Execution in all versions up to, and including, 4.89. This is due to the presence of a SQL Injection vulnerability and Local File Inclusion vulnerability that can be chained with an image upload. This makes it possible for unauthenticated attackers to execute code on the server upload image files on the server than can be fetched via a SQL injection vulnerability, and ultimately executed as PHP code through the local file inclusion vulnerability.
Product
Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager
Affected
up to 4.89
What to do
Affects up to 4.89. Update Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jul 2, 2025Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager: SQL InjectionCVE-2025-4381 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to SQL Injection via the ‘$id’ variable of the getSpace() function in all versions up to, and including, 4.89 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager
Affected
up to 4.89
What to do
Affects up to 4.89. Update Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jul 2, 2025Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager: Local File InclusionCVE-2025-4380 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.89 via the 'bsa_template' parameter of the `bsa_preview_callback` function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases .php files can can be uploaded and included, or already exist on the site.
Product
Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager
Affected
up to 4.89
What to do
Affects up to 4.89. Update Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jul 1, 2025The Opal Estate Pro – Property Management and Submission plugin for WordPress, used by the FullHouse - Real Estate Responsive WordPress Theme, is vulnerable to CVE-2025-6934 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Opal Estate Pro – Property Management and Submission plugin for WordPress, used by the FullHouse - Real Estate Responsive WordPress Theme, is vulnerable to privilege escalation via in all versions up to, and including, 1.7.5. This is due to a lack of role restriction during registration in the 'on_regiser_user' function. This makes it possible for unauthenticated attackers to arbitrarily choose the role, including the Administrator role, assigned when registering.
Affected
up to 1.7.5
What to do
Affects up to 1.7.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 27, 2025File Manager Plugin For: Unrestricted Upload of File with Dangerous TypeCVE-2025-53260 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in getredhawkstudio File Manager Plugin For Wordpress file-manager-plugin-for-wordpress allows Upload a Web Shell to a Web Server.This issue affects File Manager Plugin For Wordpress: from n/a through <= 7.5.
Product
File Manager Plugin For
Affected
up to 7.5
What to do
Affects up to 7.5. Update File Manager Plugin For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025Mobile DJ Manager: Missing AuthorizationCVE-2025-52824 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in MDJM Mobile DJ Manager mobile-dj-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mobile DJ Manager: from n/a through <= 1.7.8.3.
Product
Mobile DJ Manager
Affected
up to 1.7.8.3
What to do
Affects up to 1.7.8.3. Update Mobile DJ Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025School Management: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47574 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojoomla School Management allows Reflected XSS. This issue affects School Management: from n/a through 92.0.0.
Product
School Management
Affected
up to 92.0.0
What to do
Affects up to 92.0.0. Update School Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 25, 2025Event RSVP and Simple Event Management: Stored Cross-Site ScriptingCVE-2025-5540 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Event RSVP and Simple Event Management Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emd_mb_meta' shortcode in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Event RSVP and Simple Event Management
Affected
up to 4.1.0
What to do
Affects up to 4.1.0. Update Event RSVP and Simple Event Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jun 20, 2025Real Estate Manager: Cross-Site Request Forgery (CSRF)CVE-2025-52825 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in Rameez Iqbal Real Estate Manager real-estate-manager allows Privilege Escalation.This issue affects Real Estate Manager: from n/a through <= 7.3.
Product
Real Estate Manager
Affected
up to 7.3
What to do
Affects up to 7.3. Update Real Estate Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025Video List Manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-52821 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in thanhtungtnt Video List Manager video-list-manager allows SQL Injection.This issue affects Video List Manager: from n/a through <= 1.7.
Product
Video List Manager
Affected
up to 1.7
What to do
Affects up to 1.7. Update Video List Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025Logo Manager For Samandehi: Cross-Site Request Forgery (CSRF)CVE-2025-52780 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Mohammad Parsa Logo Manager For Samandehi samandehi-logo-manager allows Stored XSS.This issue affects Logo Manager For Samandehi: from n/a through <= 0.5.
Product
Logo Manager For Samandehi
Affected
up to 0.5
What to do
Affects up to 0.5. Update Logo Manager For Samandehi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025File Manager Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52710 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ninja Team File Manager Pro filester allows Stored XSS.This issue affects File Manager Pro: from n/a through <= 1.8.8.
Product
File Manager Pro
Affected
up to 1.8.8
What to do
Affects up to 1.8.8. Update File Manager Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025Related Products Manager for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50045 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ProWCPlugins Related Products Manager for WooCommerce related-products-manager-woocommerce allows DOM-Based XSS.This issue affects Related Products Manager for WooCommerce: from n/a through <= 1.6.2.
Product
Related Products Manager for WooCommerce
Affected
up to 1.6.2
What to do
Affects up to 1.6.2. Update Related Products Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025Real Estate Manager: Cross-Site Request Forgery (CSRF)CVE-2025-50044 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in Rameez Iqbal Real Estate Manager real-estate-manager allows Cross Site Request Forgery.This issue affects Real Estate Manager: from n/a through <= 7.3.
Product
Real Estate Manager
Affected
up to 7.3
What to do
Affects up to 7.3. Update Real Estate Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025Recipes manager - WPH: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50011 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Félix Martínez Recipes manager - WPH allows Stored XSS. This issue affects Recipes manager - WPH: from n/a through 1.0.4.
Product
Recipes manager - WPH
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Recipes manager - WPH to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily: Missing AuthorizationCVE-2025-50008 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in cscode WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily innovs-woo-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily: from n/a through <= 1.2.4.5.
Product
WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily
Affected
up to 1.2.4.5
What to do
Affects up to 1.2.4.5. Update WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.