Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

1,597 results · page 14 of 32

May 9, 2025Drag and Drop Multiple File Upload for WooCommerce: Arbitrary file uploadsCVE-2025-4403 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Drag and Drop Multiple File Upload for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.1.6 due to accepting a user‐supplied supported_type string and the uploaded filename without enforcing real extension or MIME checks within the upload() function. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Drag and Drop Multiple File Upload for WooCommerce
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update Drag and Drop Multiple File Upload for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 9, 2025Envolve: Arbitrary file uploadsCVE-2024-11617 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Envolve Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'zetra_languageUpload' and 'zetra_fontsUpload' functions in all versions up to, and including, 1.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Envolve
Affected
up to 1.0
What to do
Affects up to 1.0. Update Envolve to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
May 8, 2025Event Manager, Events Calendar, Tickets, Registrations – Eventin: Arbitrary file readCVE-2025-3419 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 4.0.26 via the proxy_image() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. CVE-2025-47445 is a duplicate of this vulnerability.
Product
Event Manager, Events Calendar, Tickets, Registrations – Eventin
Affected
up to 4.0.26
What to do
Affects up to 4.0.26. Update Event Manager, Events Calendar, Tickets, Registrations – Eventin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 8, 2025Wolmart | Multi-Vendor Marketplace WooCommerce: Arbitrary shortcode executionCVE-2024-13793 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The Wolmart | Multi-Vendor Marketplace WooCommerce Theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.8.11. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
Wolmart | Multi-Vendor Marketplace WooCommerce
Affected
up to 1.8.11
What to do
Affects up to 1.8.11. Update Wolmart | Multi-Vendor Marketplace WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
May 6, 2025LayoutBoxx: Arbitrary shortcode executionCVE-2025-2802 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The LayoutBoxx plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 0.3.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
LayoutBoxx
Affected
up to 0.3.1
What to do
Affects up to 0.3.1. Update LayoutBoxx to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordpress.org
May 5, 2025External image replace: Arbitrary file uploadsCVE-2025-4279 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The External image replace plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'external_image_replace_get_posts::replace_post' function in all versions up to, and including, 1.0.8. This makes it possible for authenticated attackers, with contributor-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
External image replace
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update External image replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 5, 2025Envolve: Arbitrary file deletionCVE-2024-11615 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Envolve Plugin plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 1.0 via the 'zetra_deleteLanguageFile' and 'zetra_deleteFontsFile' functions. This is due to the plugin not properly validating a file or its path prior to deleting it. This makes it possible for unauthenticated attackers to delete language files.
Product
Envolve
Affected
up to 1.0
What to do
Affects up to 1.0. Update Envolve to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
May 2, 2025The Motors - Car Dealer, Rental & Listing: Arbitrary shortcode executionCVE-2024-13738 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The Motors - Car Dealer, Rental & Listing WordPress theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.6.65. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. *It is unclear exactly which version the issue was patched in from the changelog. Therefore, we used the latest version at the time of verification.
Product
The Motors - Car Dealer, Rental & Listing
Affected
up to 5.6.65
What to do
Affects up to 5.6.65. Update The Motors - Car Dealer, Rental & Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record stylemixthemes.com themeforest.net
May 2, 2025Multiple plugins and/or themes for WordPress are vulnerable to Arbitrary File Uploads due to a missing capability check on the ajaxUploadFonts() function in varCVE-2024-13418 · WordPress plugins & themes · reported by WordfenceHigh 8.8
Multiple plugins and/or themes for WordPress are vulnerable to Arbitrary File Uploads due to a missing capability check on the ajaxUploadFonts() function in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files that can make remote code execution possible. This issue was escalated to Envato over two months from the date of this disclosure and the issue, while partially patched, is still vulnerable.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record themeforest.net wordfence.com
May 1, 2025NewsBlogger: Arbitrary file uploadsCVE-2025-1304 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The NewsBlogger theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the newsblogger_install_and_activate_plugin() function in all versions up to, and including, 0.2.5.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
NewsBlogger
Affected
up to 0.2.5.1
What to do
Affects up to 0.2.5.1. Update NewsBlogger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org themes.trac.wordpress.org
Apr 26, 2025The Anps Theme: Arbitrary shortcode executionCVE-2024-13812 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The The Anps Theme plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.1.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The Anps Theme
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update The Anps Theme to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record anpsthemes.com wordfence.com
Apr 26, 2025Aeropage Sync for Airtable: Arbitrary file uploadsCVE-2025-3914 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Aeropage Sync for Airtable plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'aeropage_media_downloader' function in all versions up to, and including, 3.2.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Aeropage Sync for Airtable
Affected
up to 3.2.0
What to do
Affects up to 3.2.0. Update Aeropage Sync for Airtable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 26, 2025The Create custom forms for WordPress with a smart form plugin for smart businesses: Arbitrary shortcode executionCVE-2025-2801 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The Create custom forms for WordPress with a smart form plugin for smart businesses plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.2.4. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The Create custom forms for WordPress with a smart form plugin for smart businesses
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update The Create custom forms for WordPress with a smart form plugin for smart businesses to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 25, 2025Mayosis Core: Arbitrary File ReadCVE-2025-1565 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Mayosis Core plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.4.1 via the library/wave-audio/peaks/remote_dl.php file. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
Mayosis Core
Affected
up to 5.4.1
What to do
Affects up to 5.4.1. Update Mayosis Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Apr 24, 2025Database Toolset: Arbitrary file deletionCVE-2025-3065 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Database Toolset plugin is vulnerable to arbitrary file deletion due to insufficient file path validation in a function in all versions up to, and including, 1.8.4. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
Database Toolset
Affected
up to 1.8.4
What to do
Affects up to 1.8.4. Update Database Toolset to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Apr 22, 2025Ocean Extra: Arbitrary shortcode executionCVE-2025-3472 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.6. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes when WooCommerce is also installed and activated.
Product
Ocean Extra
Affected
up to 2.4.6
What to do
Affects up to 2.4.6. Update Ocean Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 22, 2025Greenshift – animation and page builder blocks: Arbitrary file uploadsCVE-2025-3616 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the gspb_make_proxy_api_request() function in versions 11.4 to 11.4.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The arbitrary file upload was sufficiently patched in 11.4.5, but a capability check was added in 11.4.6 to properly prevent unauthorized limited file uploads.
Product
Greenshift – animation and page builder blocks
Affected
11.4 to 11.4.5
What to do
Affects 11.4 to 11.4.5. Update Greenshift – animation and page builder blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 19, 2025Download Manager: Arbitrary file deletionCVE-2025-3404 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the savePackage function in all versions up to, and including, 3.3.12. This makes it possible for authenticated attackers, with Author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
Download Manager
Affected
up to 3.3.12
What to do
Affects up to 3.3.12. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 19, 2025Wordpress Plugin Smart Product Review: Arbitrary file uploadsCVE-2021-4455 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Wordpress Plugin Smart Product Review plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.0.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Wordpress Plugin Smart Product Review
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Wordpress Plugin Smart Product Review to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com wordfence.com
Apr 19, 2025CLEVER - HTML5 Radio Player With History - Shoutcast and Icecast - Elementor Widget Addon: Arbitrary file readCVE-2025-3103 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The CLEVER - HTML5 Radio Player With History - Shoutcast and Icecast - Elementor Widget Addon plugin for WordPress is vulnerable to arbitrary file read due to insufficient file path validation in the 'history.php' file in all versions up to, and including, 2.4. This makes it possible for unauthenticated attackers to read arbitrary files on the affected site's server, which may contain sensitive information including database credentials. The vulnerability was partially patched in version 2.4.
Product
CLEVER - HTML5 Radio Player With History - Shoutcast and Icecast - Elementor Widget Addon
Affected
up to 2.4
What to do
Affects up to 2.4. Update CLEVER - HTML5 Radio Player With History - Shoutcast and Icecast - Elementor Widget Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Apr 19, 2025AIHub: Arbitrary file uploadsCVE-2025-1093 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The AIHub theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the generate_image function in all versions up to, and including, 1.3.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
AIHub
Affected
up to 1.3.7
What to do
Affects up to 1.3.7. Update AIHub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Apr 17, 2025Avatar: Arbitrary file deletionCVE-2025-3520 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Avatar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in a function in all versions up to, and including, 0.1.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
Avatar
Affected
up to 0.1.4
What to do
Affects up to 0.1.4. Update Avatar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Apr 17, 2025WP Editor: Arbitrary file readCVE-2025-3295 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The WP Editor plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.2.9.1. This makes it possible for authenticated attackers, with Administrator-level access and above, to read arbitrary files on the affected site's server which may reveal sensitive information.
Product
WP Editor
Affected
up to 1.2.9.1
What to do
Affects up to 1.2.9.1. Update WP Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 17, 2025WP Editor: Arbitrary file updateCVE-2025-3294 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Editor plugin for WordPress is vulnerable to arbitrary file update due to missing file path validation in all versions up to, and including, 1.2.9.1. This makes it possible for authenticated attackers, with Administrator-level access and above, to overwrite arbitrary files on the affected site's server which may make remote code execution possible assuming the files can be written to by the web server.
Product
WP Editor
Affected
up to 1.2.9.1
What to do
Affects up to 1.2.9.1. Update WP Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 11, 2025The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for: Arbitrary shortcode executionCVE-2025-3422 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.1.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.
Product
The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 10, 2025Nearby Locations: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32128 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in aaronfrey Nearby Locations nearby-locations allows SQL Injection.This issue affects Nearby Locations: from n/a through <= 1.1.1.
Product
Nearby Locations
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Nearby Locations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 10, 2025azurecurve Shortcodes in Comments: Arbitrary shortcode executionCVE-2025-2809 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The azurecurve Shortcodes in Comments plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.0.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
azurecurve Shortcodes in Comments
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update azurecurve Shortcodes in Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Apr 10, 2025ORDER POST: Arbitrary shortcode executionCVE-2025-2805 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The ORDER POST plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.0.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
ORDER POST
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update ORDER POST to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordpress.org
Apr 8, 2025Motors – Car Dealership & Classified Listings: Arbitrary plugin installationsCVE-2025-2807 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary plugin installations due to a missing capability check in the mvl_setup_wizard_install_plugin() function in all versions up to, and including, 1.4.64. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate arbitrary plugins on the affected site's server which may make remote code execution possible.
Product
Motors – Car Dealership & Classified Listings
Affected
up to 1.4.64
What to do
Affects up to 1.4.64. Update Motors – Car Dealership & Classified Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 8, 2025ZoomSounds - WordPress Wave Audio Player with Playlist: Arbitrary File ReadCVE-2025-3431 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 6.91 via the 'dzsap_download' action. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
ZoomSounds - WordPress Wave Audio Player with Playlist
Affected
up to 6.91
What to do
Affects up to 6.91. Update ZoomSounds - WordPress Wave Audio Player with Playlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Apr 8, 2025Simple WP Events: Arbitrary file deletionCVE-2025-2004 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Simple WP Events plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wpe_delete_file AJAX action in all versions up to, and including, 1.8.17. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). CVE-2025-32509 is a duplicate of this.
Product
Simple WP Events
Affected
up to 1.8.17
What to do
Affects up to 1.8.17. Update Simple WP Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 7, 2025Streamit: Arbitrary file uploadsCVE-2025-2525 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Streamit theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'st_Authentication_Controller::edit_profile' function in all versions up to, and including, 4.0.1. This makes it possible for authenticated attackers, with subscriber-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Streamit
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update Streamit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record documentation.iqonic.design themeforest.net
Apr 7, 2025Sreamit: Arbitrary file downloadsCVE-2025-2519 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Sreamit theme for WordPress is vulnerable to arbitrary file downloads in all versions up to, and including, 4.0.1. This is due to insufficient file validation in the 'st_send_download_file' function. This makes it possible for authenticated attackers, with subscriber-level access and above, to download arbitrary files.
Product
Sreamit
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update Sreamit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record documentation.iqonic.design themeforest.net
Apr 5, 2025Drag and Drop Multiple File Upload for WooCommerce: Arbitrary file movingCVE-2025-2941 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Drag and Drop Multiple File Upload for WooCommerce plugin for WordPress is vulnerable to arbitrary file moving due to insufficient file path validation via the wc-upload-file[] parameter in all versions up to, and including, 1.1.4. This makes it possible for unauthenticated attackers to move arbitrary files on the server, which can easily lead to remote code execution when the right file is moved (such as wp-config.php).
Product
Drag and Drop Multiple File Upload for WooCommerce
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Drag and Drop Multiple File Upload for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Apr 4, 2025The Woffice Core plugin for WordPress, used by the Woffice Theme, is vulnerable to arbitrary file uploads due to missing file type validation in the 'saveFeaturCVE-2025-2780 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Woffice Core plugin for WordPress, used by the Woffice Theme, is vulnerable to arbitrary file uploads due to missing file type validation in the 'saveFeaturedImage' function in all versions up to, and including, 5.4.21. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected
up to 5.4.21
What to do
Affects up to 5.4.21. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record hub.woffice.io wordfence.com
Apr 4, 2025Booster for WooCommerce: Arbitrary file uploadsCVE-2024-13744 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Booster for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the validate_product_input_fields_on_add_to_cart function in versions 4.0.1 to 7.2.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Booster for WooCommerce
Affected
4.0.1 to 7.2.4
What to do
Affects 4.0.1 to 7.2.4. Update Booster for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 2, 2025Front End Users: Arbitrary file uploadsCVE-2025-2005 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Front End Users plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the file uploads field of the registration form in all versions up to, and including, 3.2.32. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Front End Users
Affected
up to 3.2.32
What to do
Affects up to 3.2.32. Update Front End Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 1, 2025Clearbit Reveal: Cross-Site Request Forgery (CSRF)CVE-2025-31785 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Clearbit Clearbit Reveal clearbit allows Cross Site Request Forgery.This issue affects Clearbit Reveal: from n/a through <= 1.0.6.
Product
Clearbit Reveal
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Clearbit Reveal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Real Estate 7: Arbitrary file uploadsCVE-2025-2891 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Real Estate 7 WordPress theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the 'template-submit-listing.php' file in all versions up to, and including, 3.5.4. This makes it possible for authenticated attackers, with Seller-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible if front-end listing submission has been enabled.
Product
Real Estate 7
Affected
up to 3.5.4
What to do
Affects up to 3.5.4. Update Real Estate 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record contempothemes.com wordfence.com
Apr 1, 2025Import Export Suite for CSV and XML Datafeed: Arbitrary file uploadsCVE-2025-2008 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Import Export Suite for CSV and XML Datafeed plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import_single_post_as_csv() function in all versions up to, and including, 7.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Please note this vulnerability was reintroduced in 7.20, and subsequently patched again in 7.20.1.
Product
Import Export Suite for CSV and XML Datafeed
Affected
up to 7.19
What to do
Affects up to 7.19. Update Import Export Suite for CSV and XML Datafeed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 1, 2025Import Export Suite for CSV and XML Datafeed: Arbitrary file deletionCVE-2025-2007 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Import Export Suite for CSV and XML Datafeed plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteImage() function in all versions up to, and including, 7.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Please note this vulnerability was reintroduced in 7.20, and subsequently patched again in 7.20.1.
Product
Import Export Suite for CSV and XML Datafeed
Affected
up to 7.19
What to do
Affects up to 7.19. Update Import Export Suite for CSV and XML Datafeed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 29, 2025So-Called Air Quotes: Arbitrary shortcode executionCVE-2025-2803 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The So-Called Air Quotes plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 0.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
So-Called Air Quotes
Affected
up to 0.1
What to do
Affects up to 0.1. Update So-Called Air Quotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordpress.org
Mar 29, 2025SoJ SoundSlides: Arbitrary file uploadsCVE-2025-2249 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The SoJ SoundSlides plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the soj_soundslides_options_subpanel() function in all versions up to, and including, 1.2.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
SoJ SoundSlides
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update SoJ SoundSlides to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 29, 2025Inline Image Upload for BBPress: Arbitrary file uploadsCVE-2025-2006 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Inline Image Upload for BBPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file extension validation in the file uploading functionality in all versions up to, and including, 1.1.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. This may be exploitable by unauthenticated attackers when the "Allow guest users without accounts to create topics and replies" setting is enabled.
Product
Inline Image Upload for BBPress
Affected
up to 1.1.19
What to do
Affects up to 1.1.19. Update Inline Image Upload for BBPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 29, 2025Shortcodes by United: Arbitrary shortcode executionCVE-2024-13557 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Shortcodes by United Themes plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.1.6. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
Shortcodes by United
Affected
up to 5.1.6
What to do
Affects up to 5.1.6. Update Shortcodes by United to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record unitedthemes.com wordfence.com
Mar 28, 2025Drag and Drop Multiple File Upload for Contact Form 7: Arbitrary file deletionCVE-2025-2328 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'dnd_remove_uploaded_files' function in all versions up to, and including, 1.3.8.7. This makes it possible for unauthenticated attackers to add arbitrary file paths (such as ../../../../wp-config.php) to uploaded files on the server, which can easily lead to remote code execution when an Administrator deletes the message. Exploiting this vulnerability requires the Flamingo plugin to be installed and activated.
Product
Drag and Drop Multiple File Upload for Contact Form 7
Affected
up to 1.3.8.7
What to do
Affects up to 1.3.8.7. Update Drag and Drop Multiple File Upload for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 26, 2025Product Import Export for WooCommerce – Import Export Product CSV Suite: Arbitrary file deletionCVE-2025-1911 · WordPress plugins & themes · reported by WordfenceLow 2.7
The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the admin_log_page() function in all versions up to, and including, 2.5.0. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary log files on the server.
Product
Product Import Export for WooCommerce – Import Export Product CSV Suite
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update Product Import Export for WooCommerce – Import Export Product CSV Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 22, 2025Export and Import Users and Customers: Arbitrary file deletionCVE-2025-1972 · WordPress plugins & themes · reported by WordfenceLow 2.7
The Export and Import Users and Customers plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the admin_log_page() function in all versions up to, and including, 2.6.2. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary log files on the server.
Product
Export and Import Users and Customers
Affected
up to 2.6.2
What to do
Affects up to 2.6.2. Update Export and Import Users and Customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 20, 2025Order Export & Order Import for WooCommerce: Arbitrary file deletionCVE-2024-13922 · WordPress plugins & themes · reported by WordfenceLow 2.7
The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the admin_log_page() function in all versions up to, and including, 2.6.0. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary log files on the server.
Product
Order Export & Order Import for WooCommerce
Affected
up to 2.6.0
What to do
Affects up to 2.6.0. Update Order Export & Order Import for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 19, 2025File Away: Arbitrary file uploadsCVE-2025-2512 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The File Away plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check and missing file type validation in the upload() function in all versions up to, and including, 3.9.9.0.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
File Away
Affected
up to 3.9.9.0.1
What to do
Affects up to 3.9.9.0.1. Update File Away to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.