Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,454 results · page 14 of 30
May 15, 2025MapFig Studio: Does not have CSRF check in some placesCVE-2024-6712 · WordPress plugins & themes · reported by WPScanMedium 6.1
The MapFig Studio WordPress plugin through 0.2.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- MapFig Studio
- Affected
- up to 0.2.1
- What to do
- Affects up to 0.2.1. Update MapFig Studio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Competition Form: Does not have CSRF check in placeCVE-2024-12750 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Competition Form WordPress plugin through 2.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Competition Form
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Competition Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025JSP Store Locator: Does not have CSRF checks in some placesCVE-2024-12301 · WordPress plugins & themes · reported by WPScanMedium 6.5
The JSP Store Locator WordPress plugin through 1.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks.
- Product
- JSP Store Locator
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update JSP Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025WordPress连接微博: Does not have CSRF check in some placesCVE-2024-12282 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WordPress连接微博 WordPress plugin through 2.5.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- WordPress连接微博
- Affected
- up to 2.5.6
- What to do
- Affects up to 2.5.6. Update WordPress连接微博 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025tarteaucitron-wp: Does not have CSRF check in some placesCVE-2024-11719 · WordPress plugins & themes · reported by WPScanMedium 6.1
The tarteaucitron-wp WordPress plugin before 0.3.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- tarteaucitron-wp
- Fixed in
- 0.3.0
- What to do
- Update tarteaucitron-wp to 0.3.0 or newer.
May 15, 2025Connexion Logs: Does not have CSRF check in placeCVE-2024-11373 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Connexion Logs WordPress plugin through 3.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Connexion Logs
- Affected
- up to 3.0.2
- What to do
- Affects up to 3.0.2. Update Connexion Logs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025BTEV: Does not have CSRF check in placeCVE-2024-10677 · WordPress plugins & themes · reported by WPScanMedium 4.3
The BTEV WordPress plugin through 2.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- BTEV
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update BTEV to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Nokaut Offers Box: Does not have CSRF check in placeCVE-2024-10634 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Nokaut Offers Box WordPress plugin through 1.4.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin reset the Nokaut Offers Box WordPress plugin through 1.4.0 via a CSRF attack
- Product
- Nokaut Offers Box
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update Nokaut Offers Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025TwitterPosts: Does not have CSRF check in placeCVE-2023-7297 · WordPress plugins & themes · reported by WPScanLow 3.5
The TwitterPosts WordPress plugin through 1.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- TwitterPosts
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update TwitterPosts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025illi Link Party!: Does not have CSRF check in placeCVE-2023-7229 · WordPress plugins & themes · reported by WPScanMedium 5.5
The illi Link Party! WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
- Product
- illi Link Party!
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update illi Link Party! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Marketing Twitter Bot: Does not have CSRF check in some placesCVE-2023-7197 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Marketing Twitter Bot WordPress plugin through 1.11 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- Marketing Twitter Bot
- Affected
- up to 1.11
- What to do
- Affects up to 1.11. Update Marketing Twitter Bot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Ultimate Noindex Nofollow Tool: Does not have CSRF check in placeCVE-2023-7196 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Ultimate Noindex Nofollow Tool WordPress plugin through 1.1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Ultimate Noindex Nofollow Tool
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Ultimate Noindex Nofollow Tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025WP-Reply Notify: Does not have a CSRF check in placeCVE-2023-7195 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP-Reply Notify WordPress plugin through 1.1 does not have a CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack.
- Product
- WP-Reply Notify
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update WP-Reply Notify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025aBitGone CommentSafe: Does not have CSRF check in some placesCVE-2023-7174 · WordPress plugins & themes · reported by WPScanHigh 7.1
The aBitGone CommentSafe WordPress plugin through 1.0.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- aBitGone CommentSafe
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update aBitGone CommentSafe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Travelpayouts: All Travel Brands in One Place: Does not have CSRF check in placeCVE-2023-5934 · WordPress plugins & themes · reported by WPScanHigh 7.3
The Travelpayouts: All Travel Brands in One Place WordPress plugin before 1.1.13 does not have CSRF check in place when importing settings from the v1, which could allow attackers to make a logged in admin update some settings via a CSRF attack
- Product
- Travelpayouts: All Travel Brands in One Place
- Fixed in
- 1.1.13
- What to do
- Update Travelpayouts: All Travel Brands in One Place to 1.1.13 or newer.
May 15, 2025edd-google-sheet-connector-pro WordPress plugin before 1.4, Easy Digital Downloads Google Sheet Connector: Does not have CSRF checkCVE-2023-2334 · WordPress plugins & themes · reported by WPScanMedium 5.4
The edd-google-sheet-connector-pro WordPress plugin before 1.4, Easy Digital Downloads Google Sheet Connector WordPress plugin before 1.6.6 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a CSRF attack
- Product
- edd-google-sheet-connector-pro WordPress plugin before 1.4, Easy Digital Downloads Google Sheet Connector
- Fixed in
- 1.4
- What to do
- Update edd-google-sheet-connector-pro WordPress plugin before 1.4, Easy Digital Downloads Google Sheet Connector to 1.4 or newer.
May 12, 2025LightPress Lightbox: Does not check download links point to validCVE-2025-3649 · WordPress plugins & themes · reported by WPScanMedium 6.8
The LightPress Lightbox WordPress plugin before 2.3.4 does not check download links point to valid, non-Javascript URLs, allowing users with at least the contributor role to conduct Stored XSS attacks.
- Product
- LightPress Lightbox
- Fixed in
- 2.3.4
- What to do
- Update LightPress Lightbox to 2.3.4 or newer.
May 7, 2025Contribuinte Checkout: Cross-Site Request Forgery (CSRF)CVE-2025-47685 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Moloni Contribuinte Checkout contribuinte-checkout allows Stored XSS.This issue affects Contribuinte Checkout: from n/a through <= 2.0.03.
- Product
- Contribuinte Checkout
- Affected
- up to 2.0.03
- What to do
- Affects up to 2.0.03. Update Contribuinte Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Custom Checkout Fields for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47504 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Custom Checkout Fields for WooCommerce custom-checkout-fields-for-woocommerce allows Stored XSS.This issue affects Custom Checkout Fields for WooCommerce: from n/a through <= 1.8.3.
- Product
- Custom Checkout Fields for WooCommerce
- Affected
- up to 1.8.3
- What to do
- Affects up to 1.8.3. Update Custom Checkout Fields for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 2, 2025Multiple plugins and/or themes for WordPress are vulnerable to unauthorized access due to a missing capability check on several AJAX actions like 'gsf_reset_secCVE-2024-13420 · WordPress plugins & themes · reported by WordfenceMedium 4.3
Multiple plugins and/or themes for WordPress are vulnerable to unauthorized access due to a missing capability check on several AJAX actions like 'gsf_reset_section_options', 'gsf_reset_section_options', 'gsf_create_preset_options' and more in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset and modify some of the plugin/theme settings. This issue was escalated to Envato over two months from the date of this disclosure and the issues, while partially patched, are still vulnerable.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordthemeforest.networdfence.com
May 2, 2025Multiple plugins and/or themes for WordPress using Smart Framework are vulnerable to Stored Cross-Site Scripting due to a missing capability check on the saveOpCVE-2024-13419 · WordPress plugins & themes · reported by WordfenceMedium 6.4
Multiple plugins and/or themes for WordPress using Smart Framework are vulnerable to Stored Cross-Site Scripting due to a missing capability check on the saveOptions() and importThemeOptions() functions in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings which includes custom JavaScript that is enabled site-wide. This issue was escalated to Envato over two months from the date of this disclosure and the issue is still vulnerable.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordthemeforest.networdfence.com
May 2, 2025Multiple plugins and/or themes for WordPress are vulnerable to Arbitrary File Uploads due to a missing capability check on the ajaxUploadFonts() function in varCVE-2024-13418 · WordPress plugins & themes · reported by WordfenceHigh 8.8
Multiple plugins and/or themes for WordPress are vulnerable to Arbitrary File Uploads due to a missing capability check on the ajaxUploadFonts() function in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files that can make remote code execution possible. This issue was escalated to Envato over two months from the date of this disclosure and the issue, while partially patched, is still vulnerable.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordthemeforest.networdfence.com
Apr 30, 2025SureForms: Does not have proper authorisation checkCVE-2025-3471 · WordPress plugins & themes · reported by WPScanMedium 4.9
The SureForms WordPress plugin before 1.4.4 does not have proper authorisation check when updating its settings via the REST API, which could allow Contributor and above roles to perform such action
- Product
- SureForms
- Fixed in
- 1.4.4
- What to do
- Update SureForms to 1.4.4 or newer.
Apr 26, 2025Order Delivery Date: Does not have authorization and CSRF checksCVE-2025-2907 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Order Delivery Date WordPress plugin before 12.3.1 does not have authorization and CSRF checks when importing settings. Furthermore it also lacks proper checks to only update options relevant to the Order Delivery Date WordPress plugin before 12.3.1. This leads to attackers being able to modify the default_user_role to administrator and users_can_register, allowing them to register as an administrator of the site for complete site takeover.
- Product
- Order Delivery Date
- Fixed in
- 12.3.1
- What to do
- Update Order Delivery Date to 12.3.1 or newer.
Apr 24, 2025PayPal Express Checkout: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46499 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hccoder PayPal Express Checkout paypal-express-checkout allows Stored XSS.This issue affects PayPal Express Checkout: from n/a through <= 2.1.2.
- Product
- PayPal Express Checkout
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update PayPal Express Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025Checkout Field Visibility for WooCommerce: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39391 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in zamartz Checkout Field Visibility for WooCommerce checkout-field-visibility-for-woocommerce allows PHP Local File Inclusion.This issue affects Checkout Field Visibility for WooCommerce: from n/a through <= 1.3.0.
- Product
- Checkout Field Visibility for WooCommerce
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Checkout Field Visibility for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Klarna Checkout for WooCommerce: Exposes an unauthenticated WooCommerce Ajax endpoint that allows an attacker to flood the log files with data at the maximum size allowed for a POST parameter per requestCVE-2024-13925 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Klarna Checkout for WooCommerce WordPress plugin before 2.13.5 exposes an unauthenticated WooCommerce Ajax endpoint that allows an attacker to flood the log files with data at the maximum size allowed for a POST parameter per request. This can result in rapid consumption of disk space, potentially filling the entire disk.
- Product
- Klarna Checkout for WooCommerce
- Fixed in
- 2.13.5
- What to do
- Update Klarna Checkout for WooCommerce to 2.13.5 or newer.
Apr 16, 2025Checkout for PayPal: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39572 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor Alam Checkout for PayPal checkout-for-paypal allows Stored XSS.This issue affects Checkout for PayPal: from n/a through <= 1.0.38.
- Product
- Checkout for PayPal
- Affected
- up to 1.0.38
- What to do
- Affects up to 1.0.38. Update Checkout for PayPal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 16, 2025Checkout Files Upload for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39520 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Wham Checkout Files Upload for WooCommerce checkout-files-upload-woocommerce allows Stored XSS.This issue affects Checkout Files Upload for WooCommerce: from n/a through <= 2.2.0.
- Product
- Checkout Files Upload for WooCommerce
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update Checkout Files Upload for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2025Duplicate Title Checker: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32558 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ketanajani Duplicate Title Checker duplicate-title-checker allows Blind SQL Injection.This issue affects Duplicate Title Checker: from n/a through <= 1.2.
- Product
- Duplicate Title Checker
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Duplicate Title Checker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025Checkout Mestres WP: Incorrect Privilege AssignmentCVE-2025-32695 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in Mestres do WP Checkout Mestres WP checkout-mestres-wp allows Privilege Escalation.This issue affects Checkout Mestres WP: from n/a through <= 8.7.5.
- Product
- Checkout Mestres WP
- Affected
- up to 8.7.5
- What to do
- Affects up to 8.7.5. Update Checkout Mestres WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025WordPress/Plugin Upgrade Time Out: Does not have CSRF check in some placesCVE-2024-8243 · WordPress plugins & themes · reported by WPScanMedium 6.3
The WordPress/Plugin Upgrade Time Out Plugin WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- WordPress/Plugin Upgrade Time Out
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WordPress/Plugin Upgrade Time Out to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025WP MultiTasking: Does not have CSRF checkCVE-2024-6860 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating its permalink suffix settings, which could allow attackers to make logged admins perform such action via a CSRF attack
- Product
- WP MultiTasking
- Affected
- up to 0.1.12
- What to do
- Affects up to 0.1.12. Update WP MultiTasking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025WP MultiTasking: Does not have CSRF checkCVE-2024-6857 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating its Header, Footer and Body Script Settings, which could allow attackers to make logged admins perform such action via a CSRF attack
- Product
- WP MultiTasking
- Affected
- up to 0.1.12
- What to do
- Affects up to 0.1.12. Update WP MultiTasking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 6, 2025Broken Link Checker by AIOSEO – Easily Fix/Monitor Internal and External links: SQL InjectionCVE-2025-1264 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Broken Link Checker by AIOSEO – Easily Fix/Monitor Internal and External links plugin for WordPress is vulnerable to SQL Injection via the 'orderBy' parameter in all versions up to, and including, 1.2.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Broken Link Checker by AIOSEO – Easily Fix/Monitor Internal and External links
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Broken Link Checker by AIOSEO – Easily Fix/Monitor Internal and External links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 31, 2025Checklist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31538 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in checklistcom Checklist checklist allows Stored XSS.This issue affects Checklist: from n/a through <= 1.1.9.
- Product
- Checklist
- Affected
- up to 1.1.9
- What to do
- Affects up to 1.1.9. Update Checklist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 29, 2025Checkout Mestres do WP for WooCommerce: Unauthorized modification of data that can lead to privilege escalationCVE-2025-2266 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Checkout Mestres do WP for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the cwmpUpdateOptions() function in versions 8.6.5 to 8.7.5. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
- Product
- Checkout Mestres do WP for WooCommerce
- Affected
- 8.6.5 to 8.7.5
- What to do
- Affects 8.6.5 to 8.7.5. Update Checkout Mestres do WP for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Mar 28, 2025Ultimate Security Checker: Cross-Site Request Forgery (CSRF)CVE-2025-31456 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in bsndev Ultimate Security Checker ultimate-security-checker allows Cross Site Request Forgery.This issue affects Ultimate Security Checker: from n/a through <= 4.2.
- Product
- Ultimate Security Checker
- Affected
- up to 4.2
- What to do
- Affects up to 4.2. Update Ultimate Security Checker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2025Event Tickets with Ticket Scanner: Does not have CSRF check in placeCVE-2025-1762 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Event Tickets with Ticket Scanner WordPress plugin before 2.5.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Event Tickets with Ticket Scanner
- Fixed in
- 2.5.4
- What to do
- Update Event Tickets with Ticket Scanner to 2.5.4 or newer.
Mar 26, 2025Booknetic: Does not have CSRF checkCVE-2024-13146 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Booknetic WordPress plugin before 4.1.5 does not have CSRF check when creating Staff accounts, which could allow attackers to make logged in admin add arbitrary Staff members via a CSRF attack
- Product
- Booknetic
- Fixed in
- 4.1.5
- What to do
- Update Booknetic to 4.1.5 or newer.
Mar 25, 2025IP Based Login: Does not have CSRF checks in some placesCVE-2024-13118 · WordPress plugins & themes · reported by WPScanMedium 4.3
The IP Based Login WordPress plugin before 2.4.1 does not have CSRF checks in some places, which could allow attackers to make logged in users delete all logs via a CSRF attack
- Product
- IP Based Login
- Fixed in
- 2.4.1
- What to do
- Update IP Based Login to 2.4.1 or newer.
Mar 13, 2025Limit Bio: Does not have CSRF checkCVE-2025-1436 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Limit Bio WordPress plugin through 1.0 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- Limit Bio
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Limit Bio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 11, 2025Rankchecker.io Integration: Cross-Site Request Forgery (CSRF)CVE-2025-28857 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in rankchecker Rankchecker.io Integration rankchecker-io-integration allows Stored XSS.This issue affects Rankchecker.io Integration: from n/a through <= 1.0.9.
- Product
- Rankchecker.io Integration
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Rankchecker.io Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 11, 2025XV Random Quotes: Does not have CSRF check in placeCVE-2024-13580 · WordPress plugins & themes · reported by WPScanMedium 4.3
The XV Random Quotes WordPress plugin through 1.40 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin reset them via a CSRF attack
- Product
- XV Random Quotes
- Affected
- up to 1.40
- What to do
- Affects up to 1.40. Update XV Random Quotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 9, 2025Contact Us By Lord Linus: Does not have CSRF check in some placesCVE-2025-1382 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Us By Lord Linus WordPress plugin through 2.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- Contact Us By Lord Linus
- Affected
- up to 2.6
- What to do
- Affects up to 2.6. Update Contact Us By Lord Linus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 9, 2025URL Shortener | Conversion Tracking | AB Testing | WooCommerce: Does not have CSRF checks in some bulk actionsCVE-2025-1362 · WordPress plugins & themes · reported by WPScanMedium 4.3
The URL Shortener | Conversion Tracking | AB Testing | WooCommerce WordPress plugin through 9.0.2 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting customers via CSRF attacks
- Product
- URL Shortener | Conversion Tracking | AB Testing | WooCommerce
- Affected
- up to 9.0.2
- What to do
- Affects up to 9.0.2. Update URL Shortener | Conversion Tracking | AB Testing | WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 8, 2025Email Keep: Does not have CSRF check in placeCVE-2024-13826 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Email Keep WordPress plugin through 1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Email Keep
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Email Keep to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 1, 2025Database Backup and check Tables Automated With Scheduler 2024: Arbitrary file deletionCVE-2024-13910 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'database_backup_ajax_delete' function in all versions up to, and including, 2.35. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The vulnerability was partially patched in version 2.36.
- Product
- Database Backup and check Tables Automated With Scheduler 2024
- Affected
- up to 2.35
- What to do
- Affects up to 2.35. Update Database Backup and check Tables Automated With Scheduler 2024 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 1, 2025Database Backup and check Tables Automated With Scheduler 2024: Sensitive Information ExposureCVE-2024-13911 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.35 via the /dashboard/backup.php file. This makes it possible for authenticated attackers, with Administrator-level access and above, to extract sensitive data including full database credentials.
- Product
- Database Backup and check Tables Automated With Scheduler 2024
- Affected
- up to 2.35
- What to do
- Affects up to 2.35. Update Database Backup and check Tables Automated With Scheduler 2024 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 27, 2025ThemeMakers Stripe Checkout: Stored Cross-Site ScriptingCVE-2025-1690 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ThemeMakers Stripe Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stripe' shortcode in versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- ThemeMakers Stripe Checkout
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update ThemeMakers Stripe Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.comthemeforest.net
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.