Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

570new WordPress flaws this week

391,310entries in the database

1,589 results · page 15 of 32

Apr 4, 2025The Woffice Core plugin for WordPress, used by the Woffice Theme, is vulnerable to arbitrary file uploads due to missing file type validation in the 'saveFeaturCVE-2025-2780 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Woffice Core plugin for WordPress, used by the Woffice Theme, is vulnerable to arbitrary file uploads due to missing file type validation in the 'saveFeaturedImage' function in all versions up to, and including, 5.4.21. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected
up to 5.4.21
What to do
Affects up to 5.4.21. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record hub.woffice.io wordfence.com
Apr 4, 2025Booster for WooCommerce: Arbitrary file uploadsCVE-2024-13744 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Booster for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the validate_product_input_fields_on_add_to_cart function in versions 4.0.1 to 7.2.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Booster for WooCommerce
Affected
4.0.1 to 7.2.4
What to do
Affects 4.0.1 to 7.2.4. Update Booster for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 3, 2025CF7 Spreadsheets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31536 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in moshensky CF7 Spreadsheets cf7-spreadsheets allows Reflected XSS.This issue affects CF7 Spreadsheets: from n/a through <= 2.3.2.
Product
CF7 Spreadsheets
Affected
up to 2.3.2
What to do
Affects up to 2.3.2. Update CF7 Spreadsheets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 3, 2025Search engine keywords highlighter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31442 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e1tekoap42 Search engine keywords highlighter keywords-highlight-tool allows Reflected XSS.This issue affects Search engine keywords highlighter: from n/a through <= 0.1.3.
Product
Search engine keywords highlighter
Affected
up to 0.1.3
What to do
Affects up to 0.1.3. Update Search engine keywords highlighter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 2, 2025Front End Users: Arbitrary file uploadsCVE-2025-2005 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Front End Users plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the file uploads field of the registration form in all versions up to, and including, 3.2.32. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Front End Users
Affected
up to 3.2.32
What to do
Affects up to 3.2.32. Update Front End Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 1, 2025LeadLab by wiredminds: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31568 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wiredmindshelp LeadLab by wiredminds wiredminds-leadlab allows Reflected XSS.This issue affects LeadLab by wiredminds: from n/a through <= 1.3.
Product
LeadLab by wiredminds
Affected
up to 1.3
What to do
Affects up to 1.3. Update LeadLab by wiredminds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Oracle Cards Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30852 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in emotionalonlinestorytelling Oracle Cards Lite oracle-cards allows Reflected XSS.This issue affects Oracle Cards Lite: from n/a through <= 1.2.1.
Product
Oracle Cards Lite
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Oracle Cards Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Beds24 Online Booking: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31851 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in markkinchin Beds24 Online Booking beds24-online-booking allows Stored XSS.This issue affects Beds24 Online Booking: from n/a through <= 2.0.27.
Product
Beds24 Online Booking
Affected
up to 2.0.27
What to do
Affects up to 2.0.27. Update Beds24 Online Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Ni WooCommerce Cost Of Goods: Missing AuthorizationCVE-2025-31826 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Anzar Ahmed Ni WooCommerce Cost Of Goods ni-woocommerce-cost-of-goods allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ni WooCommerce Cost Of Goods: from n/a through <= 3.2.8.
Product
Ni WooCommerce Cost Of Goods
Affected
up to 3.2.8
What to do
Affects up to 3.2.8. Update Ni WooCommerce Cost Of Goods to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Gift Cards for WooCommerce: Missing AuthorizationCVE-2025-31781 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ahmadshyk Gift Cards for WooCommerce woo-giftcards allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gift Cards for WooCommerce: from n/a through <= 1.5.8.
Product
Gift Cards for WooCommerce
Affected
up to 1.5.8
What to do
Affects up to 1.5.8. Update Gift Cards for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Bulk Fields Editor: Missing AuthorizationCVE-2025-31752 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in termel Bulk Fields Editor bulk-user-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bulk Fields Editor: from n/a through <= 1.8.0.
Product
Bulk Fields Editor
Affected
up to 1.8.0
What to do
Affects up to 1.8.0. Update Bulk Fields Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Real Estate 7: Arbitrary file uploadsCVE-2025-2891 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Real Estate 7 WordPress theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the 'template-submit-listing.php' file in all versions up to, and including, 3.5.4. This makes it possible for authenticated attackers, with Seller-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible if front-end listing submission has been enabled.
Product
Real Estate 7
Affected
up to 3.5.4
What to do
Affects up to 3.5.4. Update Real Estate 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record contempothemes.com wordfence.com
Apr 1, 2025Ads by WPQuads: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30876 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ads by WPQuads Ads by WPQuads quick-adsense-reloaded allows SQL Injection.This issue affects Ads by WPQuads: from n/a through <= 2.0.87.1.
Product
Ads by WPQuads
Affected
up to 2.0.87.1
What to do
Affects up to 2.0.87.1. Update Ads by WPQuads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025WP2LEADS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30827 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saleswonder Team: Tobias WP2LEADS wp2leads allows Reflected XSS.This issue affects WP2LEADS: from n/a through <= 3.4.5.
Product
WP2LEADS
Affected
up to 3.4.5
What to do
Affects up to 3.4.5. Update WP2LEADS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025WP Cards: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30547 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Tufts WP Cards wp-cards allows Reflected XSS.This issue affects WP Cards: from n/a through <= 1.5.1.
Product
WP Cards
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update WP Cards to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Lana Downloads Manager: Does not validate user input used in a pathCVE-2025-2048 · WordPress plugins & themes · reported by WPScanMedium 4.1
The Lana Downloads Manager WordPress plugin before 1.10.0 does not validate user input used in a path, which could allow users with an admin role to perform path traversal attacks and download arbitrary files on the server
Product
Lana Downloads Manager
Fixed in
1.10.0
What to do
Update Lana Downloads Manager to 1.10.0 or newer.
Full record and what to do →NVD record wpscan.com
Apr 1, 2025Import Export Suite for CSV and XML Datafeed: Arbitrary file uploadsCVE-2025-2008 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Import Export Suite for CSV and XML Datafeed plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import_single_post_as_csv() function in all versions up to, and including, 7.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Please note this vulnerability was reintroduced in 7.20, and subsequently patched again in 7.20.1.
Product
Import Export Suite for CSV and XML Datafeed
Affected
up to 7.19
What to do
Affects up to 7.19. Update Import Export Suite for CSV and XML Datafeed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 31, 2025CF7 Spreadsheets: Missing AuthorizationCVE-2025-31603 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in moshensky CF7 Spreadsheets cf7-spreadsheets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CF7 Spreadsheets: from n/a through <= 2.3.2.
Product
CF7 Spreadsheets
Affected
up to 2.3.2
What to do
Affects up to 2.3.2. Update CF7 Spreadsheets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025Ads by WPQuads: Missing AuthorizationCVE-2025-30855 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Ads by WPQuads Ads by WPQuads quick-adsense-reloaded allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ads by WPQuads: from n/a through <= 2.0.87.1.
Product
Ads by WPQuads
Affected
up to 2.0.87.1
What to do
Affects up to 2.0.87.1. Update Ads by WPQuads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 29, 2025SoJ SoundSlides: Arbitrary file uploadsCVE-2025-2249 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The SoJ SoundSlides plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the soj_soundslides_options_subpanel() function in all versions up to, and including, 1.2.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
SoJ SoundSlides
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update SoJ SoundSlides to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 29, 2025Inline Image Upload for BBPress: Arbitrary file uploadsCVE-2025-2006 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Inline Image Upload for BBPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file extension validation in the file uploading functionality in all versions up to, and including, 1.1.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. This may be exploitable by unauthenticated attackers when the "Allow guest users without accounts to create topics and replies" setting is enabled.
Product
Inline Image Upload for BBPress
Affected
up to 1.1.19
What to do
Affects up to 1.1.19. Update Inline Image Upload for BBPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 28, 2025OmniLeads Scripts and Tags Manager: Cross-Site Request Forgery (CSRF)CVE-2025-31460 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in danielmuldernl OmniLeads Scripts and Tags Manager omnileads-scripts-and-tags-manager allows Stored XSS.This issue affects OmniLeads Scripts and Tags Manager: from n/a through <= 1.3.
Product
OmniLeads Scripts and Tags Manager
Affected
up to 1.3
What to do
Affects up to 1.3. Update OmniLeads Scripts and Tags Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 28, 2025Magic Embeds: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31433 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Miguel Sirvent Magic Embeds wp-embed-facebook allows Stored XSS.This issue affects Magic Embeds: from n/a through <= 3.1.2.
Product
Magic Embeds
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update Magic Embeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Custom Fields Account Registration For Woocommerce: Cross-Site Request Forgery (CSRF)CVE-2025-30888 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in silverplugins217 Custom Fields Account Registration For Woocommerce custom-fields-account-registration-for-woocommerce allows Cross Site Request Forgery.This issue affects Custom Fields Account Registration For Woocommerce: from n/a through <= 1.1.
Product
Custom Fields Account Registration For Woocommerce
Affected
up to 1.1
What to do
Affects up to 1.1. Update Custom Fields Account Registration For Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Export All Posts, Products, Orders, Refunds & Users: PHP Object InjectionCVE-2025-2332 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.13 via deserialization of untrusted input in the 'returnMetaValueAsCustomerInput' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Product
Export All Posts, Products, Orders, Refunds & Users
Affected
up to 2.13
What to do
Affects up to 2.13. Update Export All Posts, Products, Orders, Refunds & Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 25, 2025Easy Digital Downloads – eCommerce Payments and Subscriptions made easy: Sensitive Information ExposureCVE-2025-2252 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.6.1 via the edd_ajax_get_download_title() function. This makes it possible for unauthenticated attackers to extract private post titles of downloads. The impact here is minimal.
Product
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
Affected
up to 3.3.6.1
What to do
Affects up to 3.3.6.1. Update Easy Digital Downloads – eCommerce Payments and Subscriptions made easy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 25, 2025Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings: Unauthorized access and modification of dataCVE-2025-2224 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the 'parse_query' function in all versions up to, and including, 8.2. This makes it possible for unauthenticated attackers to update the post_status of any post to 'publish'.
Product
Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings
Affected
up to 8.2
What to do
Affects up to 8.2. Update Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 24, 2025Replace Default Words: Cross-Site Request Forgery (CSRF)CVE-2025-30612 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in mandegarweb Replace Default Words replace-default-words allows Stored XSS.This issue affects Replace Default Words: from n/a through <= 1.3.
Product
Replace Default Words
Affected
up to 1.3
What to do
Affects up to 1.3. Update Replace Default Words to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025AdSense Privacy Policy: Cross-Site Request Forgery (CSRF)CVE-2025-30578 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in hotvanrod AdSense Privacy Policy adsense-privacy-policy allows Stored XSS.This issue affects AdSense Privacy Policy: from n/a through <= 1.1.1.
Product
AdSense Privacy Policy
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update AdSense Privacy Policy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025Fix Rss Feeds: Cross-Site Request Forgery (CSRF)CVE-2025-30556 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in flyaga Fix Rss Feeds fix-rss-feed allows Cross Site Request Forgery.This issue affects Fix Rss Feeds: from n/a through <= 3.1.
Product
Fix Rss Feeds
Affected
up to 3.1
What to do
Affects up to 3.1. Update Fix Rss Feeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 23, 2025Pods: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2025-1446 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Pods WordPress plugin before 3.2.8.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
Product
Pods
Fixed in
3.2.8.2
What to do
Update Pods to 3.2.8.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 21, 2025Motors – Car Dealer, Classifieds & Listing: Unauthorized modification of dataCVE-2024-13737 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability checks on the motors_create_template and motors_delete_template functions in all versions up to, and including, 1.4.57. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary posts or create listing templates. This issue requires Elementor plugin to be installed, which is a required plugin for Motors Starter Theme.
Product
Motors – Car Dealer, Classifieds & Listing
Affected
up to 1.4.57
What to do
Affects up to 1.4.57. Update Motors – Car Dealer, Classifieds & Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 20, 2025Custom Twitter Feeds – A Tweets Widget or X Feed Widget: Cross-Site Request ForgeryCVE-2025-1314 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.5. This is due to missing or incorrect nonce validation on the ctf_clear_cache_admin() function. This makes it possible for unauthenticated attackers to reset the plugin's cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Custom Twitter Feeds – A Tweets Widget or X Feed Widget
Affected
up to 2.2.5
What to do
Affects up to 2.2.5. Update Custom Twitter Feeds – A Tweets Widget or X Feed Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 19, 2025File Away: Arbitrary file uploadsCVE-2025-2512 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The File Away plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check and missing file type validation in the upload() function in all versions up to, and including, 3.9.9.0.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
File Away
Affected
up to 3.9.9.0.1
What to do
Affects up to 3.9.9.0.1. Update File Away to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Mar 19, 2025Site Reviews: Does not properly sanitise and escape some of its Review fieldsCVE-2025-1232 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Site Reviews WordPress plugin before 7.2.5 does not properly sanitise and escape some of its Review fields, which could allow unauthenticated users to perform Stored XSS attacks
Product
Site Reviews
Fixed in
7.2.5
What to do
Update Site Reviews to 7.2.5 or newer.
Full record and what to do →NVD record wpscan.com
Mar 12, 2025GDPR Cookie Compliance – Cookie Banner, Cookie Consent, Cookie Notice – CCPA, DSGVO, RGPD: Stored Cross-Site ScriptingCVE-2025-2205 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The GDPR Cookie Compliance – Cookie Banner, Cookie Consent, Cookie Notice – CCPA, DSGVO, RGPD plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.15.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
GDPR Cookie Compliance – Cookie Banner, Cookie Consent, Cookie Notice – CCPA, DSGVO, RGPD
Affected
up to 4.15.6
What to do
Affects up to 4.15.6. Update GDPR Cookie Compliance – Cookie Banner, Cookie Consent, Cookie Notice – CCPA, DSGVO, RGPD to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record research.cleantalk.org wpscan.com
Mar 8, 2025Product Input Fields for WooCommerce: Arbitrary file uploadsCVE-2024-13359 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the add_product_input_fields_to_order_item_meta() function in all versions up to, and including, 1.12.0. This may make it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Please note that by default the plugin is only vulnerable to a double extension file upload attack, unless an administrators leaves the accepted file extensions field blank which can make .php file uploads possible. Please note 1.12.2 was mistakenly marked as patched while 1.12.1 was marked as vulnerable for a short period of time, this is not the case and 1.12.1 is fully patched.
Product
Product Input Fields for WooCommerce
Affected
up to 1.12.0
What to do
Affects up to 1.12.0. Update Product Input Fields for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 8, 2025Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit: Arbitrary file uploadsCVE-2024-13882 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'aiomatic_generate_featured_image' function in all versions up to, and including, 2.3.8. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit
Affected
up to 2.3.8
What to do
Affects up to 2.3.8. Update Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record coderevolution.ro wordfence.com
Mar 8, 2025SMTP by BestWebSoft: Arbitrary file uploadsCVE-2024-13908 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The SMTP by BestWebSoft plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_options' function in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
SMTP by BestWebSoft
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update SMTP by BestWebSoft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 7, 2025UiPress lite | Effortless custom dashboards, admin themes and pages: Unauthorized modification of data that can lead to privilege escalationCVE-2025-1309 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the uip_save_form_as_option() function in all versions up to, and including, 3.5.04. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
UiPress lite | Effortless custom dashboards, admin themes and pages
Affected
up to 3.5.04
What to do
Affects up to 3.5.04. Update UiPress lite | Effortless custom dashboards, admin themes and pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 6, 2025Ad Inserter - Ad Manager and AdSense Ads 2.8.0 was found to be vulnerable.CVE-2025-22623 · WordPress plugins & themes · reported by help@fluidattacks.comMedium 5.1
Ad Inserter - Ad Manager and AdSense Ads 2.8.0 was found to be vulnerable. The web application dynamically generates web content without validating the source of the potentially untrusted data in myapp/includes/dst/dst.php.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record fluidattacks.com wordpress.org
Mar 5, 2025Spreadsheet Integration: Cross-Site Request ForgeryCVE-2025-1463 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Spreadsheet Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.2. This is due to improper nonce validation within the class-wpgsi-show.php script. This makes it possible for unauthenticated attackers to publish arbitrary posts, including private, granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Spreadsheet Integration
Affected
up to 3.8.2
What to do
Affects up to 3.8.2. Update Spreadsheet Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 5, 2025ZoomSounds - WordPress Wave Audio Player with Playlist: PHP Object InjectionCVE-2024-13777 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.91 via deserialization of untrusted input from the 'margs' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Product
ZoomSounds - WordPress Wave Audio Player with Playlist
Affected
up to 6.91
What to do
Affects up to 6.91. Update ZoomSounds - WordPress Wave Audio Player with Playlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Mar 4, 2025Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction: Unauthorized access to functionalityCVE-2024-13724 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction plugin for WordPress is vulnerable to unauthorized access to functionality in all versions up to, and including, 2.6.2. This makes it possible for unauthenticated attackers to increase their own wallet balance, transfer balances between arbitrary users and initiate transfer requests from other users' wallets.
Product
Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction
Affected
up to 2.6.2
What to do
Affects up to 2.6.2. Update Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 4, 2025Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction: Cross-Site Request ForgeryCVE-2024-13682 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.2. This is due to missing or incorrect nonce validation in class-wallet-user-table.php. This makes it possible for unauthenticated attackers to modify wallet balances via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction
Affected
up to 2.6.2
What to do
Affects up to 2.6.2. Update Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 4, 2025Newscrunch: Arbitrary file uploadsCVE-2025-1307 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Newscrunch theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check in the newscrunch_install_and_activate_plugin() function in all versions up to, and including, 1.8.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Newscrunch
Affected
up to 1.8.4.1
What to do
Affects up to 1.8.4.1. Update Newscrunch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org themes.trac.wordpress.org
Mar 3, 2025EP4 More Embeds: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25083 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dave Lavoie EP4 More Embeds ep4-more-embeds allows Stored XSS.This issue affects EP4 More Embeds: from n/a through <= 1.0.0.
Product
EP4 More Embeds
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update EP4 More Embeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025DsgnWrks Twitter Importer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23762 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Justin Sternberg DsgnWrks Twitter Importer dsgnwrks-twitter-importer allows Reflected XSS.This issue affects DsgnWrks Twitter Importer: from n/a through <= 1.1.4.
Product
DsgnWrks Twitter Importer
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update DsgnWrks Twitter Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Ps Ads Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23738 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Padam Shankhadev Ps Ads Pro ps-ads-pro allows Reflected XSS.This issue affects Ps Ads Pro: from n/a through <= 1.0.0.
Product
Ps Ads Pro
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Ps Ads Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Awesome Twitter Feeds: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23451 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in titodevera Awesome Twitter Feeds awesome-twitter-feeds allows Reflected XSS.This issue affects Awesome Twitter Feeds: from n/a through <= 1.0.
Product
Awesome Twitter Feeds
Affected
up to 1.0
What to do
Affects up to 1.0. Update Awesome Twitter Feeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.