Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

1,763 results · page 13 of 36

Sep 22, 2025Library Bookshelves: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57964 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in photonicgnostic Library Bookshelves library-bookshelves allows Stored XSS.This issue affects Library Bookshelves: from n/a through <= 5.11.
Product
Library Bookshelves
Affected
up to 5.11
What to do
Affects up to 5.11. Update Library Bookshelves to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 19, 2025Embed PDF for WPForms: Arbitrary file uploadsCVE-2025-10647 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Embed PDF for WPForms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_handler_download_pdf_media function in all versions up to, and including, 1.1.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Embed PDF for WPForms
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update Embed PDF for WPForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Sep 18, 2025Goza - Nonprofit Charity: Unauthorized arbitrary file uploadsCVE-2025-10690 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Goza - Nonprofit Charity WordPress Theme theme for WordPress is vulnerable to unauthorized arbitrary file uploads due to a missing capability check on the 'beplus_import_pack_install_plugin' function in all versions up to, and including, 3.2.2. This makes it possible for unauthenticated attackers to upload zip files containing webshells disguised as plugins from remote locations to achieve remote code execution.
Product
Goza - Nonprofit Charity
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update Goza - Nonprofit Charity to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net cve.org
Sep 17, 2025StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More: Arbitrary file uploadsCVE-2025-9216 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import() function in all versions up to, and including, 1.5.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Sep 17, 2025WP Import – Ultimate CSV XML Importer for: Arbitrary file deletionCVE-2025-10058 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the upload_function() function in all versions up to, and including, 7.27. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
WP Import – Ultimate CSV XML Importer for
Affected
up to 7.27
What to do
Affects up to 7.27. Update WP Import – Ultimate CSV XML Importer for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 12, 2025The Hack Repair Guy's Plugin Archiver: Arbitrary file deletionCVE-2025-10176 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The The Hack Repair Guy's Plugin Archiver plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the prepare_items function in all versions up to, and including, 2.0.4. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
The Hack Repair Guy's Plugin Archiver
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update The Hack Repair Guy's Plugin Archiver to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 12, 2025LWS Cleaner: Arbitrary file deletionCVE-2025-8575 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The LWS Cleaner plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'lws_cl_delete_file' function in all versions up to, and including, 2.4.1.3. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
LWS Cleaner
Affected
up to 2.4.1.3
What to do
Affects up to 2.4.1.3. Update LWS Cleaner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 12, 2025jQuery Colorbox: Uses the colorbox libraryCVE-2025-3650 · WordPress plugins & themes · reported by WPScanLow 3.5
The jQuery Colorbox WordPress plugin through 4.6.3 uses the colorbox library, which does not sanitize title attributes on links before using them, allowing users with at least the contributor role to conduct XSS attacks against administrators.
Product
jQuery Colorbox
Affected
up to 4.6.3
What to do
Affects up to 4.6.3. Update jQuery Colorbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 11, 2025User Meta – User Profile Builder and User management: Arbitrary file deletionCVE-2025-9693 · WordPress plugins & themes · reported by WordfenceHigh 8
The User Meta – User Profile Builder and User management plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the postInsertUserProcess function in all versions up to, and including, 3.1.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
User Meta – User Profile Builder and User management
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update User Meta – User Profile Builder and User management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 11, 2025Propovoice: All-in-One Client Management System: Arbitrary File ReadCVE-2025-8422 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.7.6.7 via the send_email() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
Propovoice: All-in-One Client Management System
Affected
up to 1.7.6.7
What to do
Affects up to 1.7.6.7. Update Propovoice: All-in-One Client Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 11, 2025CatFolders – Tame Your WordPress Media Library by Category: Time-based SQL InjectionCVE-2025-9776 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The CatFolders – Tame Your WordPress Media Library by Category plugin for WordPress is vulnerable to time-based SQL Injection via the CSV Import contents in all versions up to, and including, 2.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
CatFolders – Tame Your WordPress Media Library by Category
Affected
up to 2.5.2
What to do
Affects up to 2.5.2. Update CatFolders – Tame Your WordPress Media Library by Category to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 10, 2025Responsive Filterable Portfolio: Arbitrary file uploadsCVE-2025-10049 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Responsive Filterable Portfolio plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the HdnMediaSelection_image field in all versions up to, and including, 1.0.24. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Responsive Filterable Portfolio
Affected
up to 1.0.24
What to do
Affects up to 1.0.24. Update Responsive Filterable Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2025Import any XML, CSV or Excel File to: Arbitrary file uploadsCVE-2025-10001 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Import any XML, CSV or Excel File to WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import functionality in all versions up to, and including, 3.9.3. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload unsafe files like .phar files on the affected site's server which may make remote code execution possible.
Product
Import any XML, CSV or Excel File to
Affected
up to 3.9.3
What to do
Affects up to 3.9.3. Update Import any XML, CSV or Excel File to to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 9, 2025Goza - Nonprofit Charity: Arbitrary file deletionCVE-2025-10134 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Goza - Nonprofit Charity WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the alone_import_pack_restore_data() function in all versions up to, and including, 3.2.2. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
Goza - Nonprofit Charity
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update Goza - Nonprofit Charity to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Sep 9, 2025The WP-Members Membership: Arbitrary shortcode executionCVE-2025-9489 · WordPress plugins & themes · reported by WordfenceMedium 5
The The WP-Members Membership Plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.5.4.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.
Product
The WP-Members Membership
Affected
up to 3.5.4.2
What to do
Affects up to 3.5.4.2. Update The WP-Members Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 8, 2025Doccure: Arbitrary User Password ChangeCVE-2025-9114 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Doccure theme for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.5.0. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts.
Product
Doccure
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update Doccure to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Sep 8, 2025Doccure Core: Arbitrary file uploadsCVE-2025-9113 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Doccure Core plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'doccure_temp_upload_to_media' function in all versions up to, and including, 1.5.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Doccure Core
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update Doccure Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Sep 8, 2025Doccure: Arbitrary file uploadsCVE-2025-9112 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Doccure theme for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the 'doccure_temp_file_uploader' function in all versions up to, and including, 1.5.0. This makes it possible for authenticated attackers, with subscriber-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Doccure
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update Doccure to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Sep 5, 2025Multi Step Form: Arbitrary file uploadsCVE-2025-9515 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Multi Step Form plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the import functionality in all versions up to, and including, 1.7.25. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Multi Step Form
Affected
up to 1.7.25
What to do
Affects up to 1.7.25. Update Multi Step Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Sep 5, 2025The REHub - Price Comparison, Multi Vendor Marketplace: Arbitrary shortcode executionCVE-2025-7366 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The REHub - Price Comparison, Multi Vendor Marketplace Wordpress Theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 19.9.7. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The REHub - Price Comparison, Multi Vendor Marketplace
Affected
up to 19.9.7
What to do
Affects up to 19.9.7. Update The REHub - Price Comparison, Multi Vendor Marketplace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Sep 4, 2025atec Debug: Arbitrary file deletionCVE-2025-9518 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The atec Debug plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation on the 'debug_path' parameter in all versions up to, and including, 1.2.22. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
atec Debug
Affected
up to 1.2.22
What to do
Affects up to 1.2.22. Update atec Debug to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 4, 2025atec Debug: Arbitrary file readCVE-2025-9516 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The atec Debug plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.2.22 via the 'custom_log' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to view the contents of files outside of the originally intended directory.
Product
atec Debug
Affected
up to 1.2.22
What to do
Affects up to 1.2.22. Update atec Debug to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 4, 2025Make Connector: Arbitrary file uploadsCVE-2025-6085 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Make Connector plugin for WordPress is vulnerable to arbitrary file uploads due to misconfigured file type validation in the 'upload_media' function in all versions up to, and including, 1.5.10. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Make Connector
Affected
up to 1.5.10
What to do
Affects up to 1.5.10. Update Make Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Aug 29, 2025Booster for WooCommerce: Arbitrary file uploadsCVE-2024-13342 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Booster for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'add_files_to_order' function in all versions up to, and including, 7.2.4. This makes it possible for unauthenticated attackers to upload arbitrary files with double extensions on the affected site's server which may make remote code execution possible. This is only exploitable on select instances where the configuration will execute the first extension present.
Product
Booster for WooCommerce
Affected
up to 7.2.4
What to do
Affects up to 7.2.4. Update Booster for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 28, 2025WP ULike Pro: Arbitrary file uploadsCVE-2024-9648 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP ULike Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the WP_Ulike_Pro_File_Uploader class in all versions up to, and including, 1.9.3. This makes it possible for unauthenticated attackers to upload limited arbitrary files like .php2, .php6, .php7, .phps, .pht, .phtm, .pgif, .shtml, .phar, .inc, .hphp, .ctp, .module, .html, .svg on the affected site's server which may make make other attacks like Cross-Site Scripting possible. Only versions up to 1.8.7 were confirmed vulnerable, however, the earliest tested version for a patch we have access to is 1.9.4, so we are considering 1.9.4 the patched version.
Product
WP ULike Pro
Affected
up to 1.9.3
What to do
Affects up to 1.9.3. Update WP ULike Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpulike.com wordfence.com
Aug 23, 2025Wptobe-memberships: Arbitrary file deletionCVE-2025-9048 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Wptobe-memberships plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the del_img_ajax_call() function in all versions up to, and including, 3.4.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
Wptobe-memberships
Affected
up to 3.4.2
What to do
Affects up to 3.4.2. Update Wptobe-memberships to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Aug 21, 2025WP Webhooks: Arbitrary file copyCVE-2025-8895 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP Webhooks plugin for WordPress is vulnerable to arbitrary file copy due to missing validation of user-supplied input in all versions up to, and including, 3.3.5. This makes it possible for unauthenticated attackers to copy arbitrary files on the affected site's server to arbitrary locations. This can be used to copy the contents of wp-config.php into a text file which can then be accessed in a browser to reveal database credentials.
Product
WP Webhooks
Affected
up to 3.3.5
What to do
Affects up to 3.3.5. Update WP Webhooks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 19, 2025Redirection for Contact Form 7: Arbitrary file deletionCVE-2025-8141 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_associated_files function in all versions up to, and including, 3.2.4. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
Redirection for Contact Form 7
Affected
up to 3.2.4
What to do
Affects up to 3.2.4. Update Redirection for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 19, 2025Media Library Assistant: Arbitrary file deletion in the /wp-content/uploads directoryCVE-2025-8357 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Media Library Assistant plugin for WordPress is vulnerable to arbitrary file deletion in the /wp-content/uploads directory due to insufficient file path validation and user capability checking in the _process_mla_download_file function in all versions up to, and including, 3.27. This makes it possible for authenticated attackers, with Author-level access and above, to delete arbitrary files on the server from the /wp-content/uploads/ directory.
Product
Media Library Assistant
Affected
up to 3.27
What to do
Affects up to 3.27. Update Media Library Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 16, 2025The Soledad: Arbitrary shortcode executionCVE-2025-8105 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The Soledad theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.6.7. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The Soledad
Affected
up to 8.6.7
What to do
Affects up to 8.6.7. Update The Soledad to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Aug 16, 2025StoryChief: Arbitrary file uploadsCVE-2025-7441 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The StoryChief plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.0.42. This vulnerability occurs through the /wp-json/storychief/webhook REST-API endpoint that does not have sufficient filetype validation. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
StoryChief
Affected
up to 1.0.42
What to do
Affects up to 1.0.42. Update StoryChief to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 16, 2025School Management System for: Arbitrary file uploadsCVE-2025-6079 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The School Management System for Wordpress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the homework.php file in all versions up to, and including, 93.2.0. This makes it possible for authenticated attackers, with Student-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. CVE-2025-31100 is potentially a duplicate of this.
Product
School Management System for
Affected
up to 93.2.0
What to do
Affects up to 93.2.0. Update School Management System for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Aug 15, 2025Icons Factory: Arbitrary File DeletionCVE-2025-7778 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Icons Factory plugin for WordPress is vulnerable to Arbitrary File Deletion due to insufficient authorization and improper path validation within the delete_files() function in all versions up to, and including, 1.6.12. This makes it possible for unauthenticated attackers to to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
Icons Factory
Affected
up to 1.6.12
What to do
Affects up to 1.6.12. Update Icons Factory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 15, 2025Assistant for NextGEN Gallery: Arbitrary directory deletionCVE-2025-7641 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Assistant for NextGEN Gallery plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation in the /wp-json/nextgenassistant/v1.0.0/control REST endpoint in all versions up to, and including, 1.0.9. This makes it possible for unauthenticated attackers to delete arbitrary directories on the server, which can cause a complete loss of availability.
Product
Assistant for NextGEN Gallery
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update Assistant for NextGEN Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 15, 2025Bit Form builder: Arbitrary file uploadsCVE-2025-6679 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Bit Form builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 2.20.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. For this to be exploitable, the PRO version needs to be installed and activated as well. Additionally a form with an advanced file upload element needs to be published.
Product
Bit Form builder
Affected
up to 2.20.4
What to do
Affects up to 2.20.4. Update Bit Form builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 12, 2025B Slider- Gutenberg Slider Block for WP: Arbitrary Plugin InstallationCVE-2025-8418 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The B Slider- Gutenberg Slider Block for WP plugin for WordPress is vulnerable to Arbitrary Plugin Installation in all versions up to, and including, 1.1.30. This is due to missing capability checks on the activated_plugin function. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins on the server which can make remote code execution possible.
Product
B Slider- Gutenberg Slider Block for WP
Affected
up to 1.1.30
What to do
Affects up to 1.1.30. Update B Slider- Gutenberg Slider Block for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 12, 2025Elementor: Arbitrary File ReadCVE-2025-8081 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Elementor plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.30.2 via the Import_Images::import() function due to insufficient controls on the filename specified. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
Elementor
Affected
up to 3.30.2
What to do
Affects up to 3.30.2. Update Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Aug 12, 2025UiCore Elements – Free Elementor widgets and templates: Arbitrary File ReadCVE-2025-6253 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The UiCore Elements – Free Elementor widgets and templates plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.3.0 via the prepare_template() function due to a missing capability check and insufficient controls on the filename specified. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
UiCore Elements – Free Elementor widgets and templates
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update UiCore Elements – Free Elementor widgets and templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 11, 2025WooCommerce Purchase Orders: Arbitrary file deletionCVE-2025-5391 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The WooCommerce Purchase Orders plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_file() function in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
WooCommerce Purchase Orders
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update WooCommerce Purchase Orders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 5, 2025FileBird – WordPress Media Library Folders & File Manager: SQL InjectionCVE-2025-6986 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to SQL Injection via the 'search' parameter in all versions up to, and including, 6.4.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
FileBird – WordPress Media Library Folders & File Manager
Affected
up to 6.4.8
What to do
Affects up to 6.4.8. Update FileBird – WordPress Media Library Folders & File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 5, 2025upload.php: The WordPress plugin Asset-Manager version 2.0 and below contains an unauthenticated arbitrary file uploadCVE-2012-10026 · WordPress plugins & themes · reported by VulnCheckCritical 10
The WordPress plugin Asset-Manager version 2.0 and below contains an unauthenticated arbitrary file upload vulnerability in upload.php. The endpoint fails to properly validate and restrict uploaded file types, allowing remote attackers to upload malicious PHP scripts to a predictable temporary directory. Once uploaded, the attacker can execute the file via a direct HTTP GET request, resulting in remote code execution under the web server’s context.
Product
upload.php
What to do
Update upload.php to the newest version.
Full record and what to do →NVD record web.archive.org raw.githubusercontent.com
Aug 5, 2025WP Import Export Lite: Arbitrary file uploadsCVE-2025-6207 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpie_tempalte_import' function in all versions up to, and including, 3.9.28. This makes it possible for authenticated attackers, with Subscriber-level access and above, and permissions granted by an Administrator, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
WP Import Export Lite
Affected
up to 3.9.28
What to do
Affects up to 3.9.28. Update WP Import Export Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 5, 2025WP Import Export Lite: Arbitrary file uploadsCVE-2025-5061 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpie_parse_upload_data' function in all versions up to, and including, 3.9.29. This makes it possible for authenticated attackers, with Subscriber-level access and above, and permissions granted by an Administrator, to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability was partially patched in version 3.9.29.
Product
WP Import Export Lite
Affected
up to 3.9.29
What to do
Affects up to 3.9.29. Update WP Import Export Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 2, 2025Woffice Core: Arbitrary file deletionCVE-2025-7694 · WordPress plugins & themes · reported by WordfenceMedium 6.8
The Woffice Core plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the woffice_file_manager_delete() function in all versions up to, and including, 5.4.26. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
Woffice Core
Affected
up to 5.4.26
What to do
Affects up to 5.4.26. Update Woffice Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record hub.woffice.io themeforest.net
Aug 1, 2025BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript: Arbitrary file uploadsCVE-2025-7443 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the store_javascript_cache.php file in all versions up to, and including, 2.2.42. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript
Affected
up to 2.2.42
What to do
Affects up to 2.2.42. Update BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 31, 2025NinjaScanner – Virus & Malware scan: Arbitrary file deletionCVE-2025-8213 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The NinjaScanner – Virus & Malware scan plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'nscan_ajax_quarantine' and 'nscan_quarantine_select' functions in all versions up to, and including, 3.2.5. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, including files outside the WordPress root directory.
Product
NinjaScanner – Virus & Malware scan
Affected
up to 3.2.5
What to do
Affects up to 3.2.5. Update NinjaScanner – Virus & Malware scan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 31, 2025AI Engine: Arbitrary file uploadsCVE-2025-7847 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The AI Engine plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the rest_simpleFileUpload() function in versions 2.9.3 and 2.9.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server when the REST API is enabled, which may make remote code execution possible.
Product
AI Engine
What to do
Update AI Engine to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 26, 2025Kallyas: Arbitrary folder deletionCVE-2025-6989 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Kallyas theme for WordPress is vulnerable to arbitrary folder deletion due to insufficient file path validation in the delete_font() function in all versions up to, and including, 4.21.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary folders on the server.
Product
Kallyas
Affected
up to 4.21.0
What to do
Affects up to 4.21.0. Update Kallyas to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Jul 25, 2025Droip: Arbitrary file uploadsCVE-2025-5831 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Droip plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the make_google_font_offline() function in all versions up to, and excluding, 2.5.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Droip
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update Droip to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record droip.com wordfence.com
Jul 24, 2025Responsive Thumbnail Slider: Arbitrary file uploadsCVE-2015-10144 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Responsive Thumbnail Slider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type sanitization in the via the image uploader in versions up to 1.0.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected sites server using a double extension which may make remote code execution possible.
Product
Responsive Thumbnail Slider
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Responsive Thumbnail Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cxsecurity.com raw.githubusercontent.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.