Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

1,853 results · page 15 of 38

Dec 18, 2025WP Gravity Forms Constant Contact: Deserialization of Untrusted DataCVE-2025-60174 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Constant Contact Plugin gf-constant-contact allows Object Injection.This issue affects WP Gravity Forms Constant Contact Plugin: from n/a through <= 1.1.2.
Product
WP Gravity Forms Constant Contact
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update WP Gravity Forms Constant Contact to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025WP Gravity Forms Zoho CRM and Bigin: Deserialization of Untrusted DataCVE-2025-60091 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Zoho CRM and Bigin gf-zoho allows Object Injection.This issue affects WP Gravity Forms Zoho CRM and Bigin: from n/a through <= 1.2.9.
Product
WP Gravity Forms Zoho CRM and Bigin
Affected
up to 1.2.9
What to do
Affects up to 1.2.9. Update WP Gravity Forms Zoho CRM and Bigin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025WP Gravity Forms Insightly: Deserialization of Untrusted DataCVE-2025-60090 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Insightly gf-insightly allows Object Injection.This issue affects WP Gravity Forms Insightly: from n/a through <= 1.1.6.
Product
WP Gravity Forms Insightly
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update WP Gravity Forms Insightly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025WP Gravity Forms FreshDesk: Deserialization of Untrusted DataCVE-2025-60089 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms FreshDesk Plugin gf-freshdesk allows Object Injection.This issue affects WP Gravity Forms FreshDesk Plugin: from n/a through <= 1.3.5.
Product
WP Gravity Forms FreshDesk
Affected
up to 1.3.5
What to do
Affects up to 1.3.5. Update WP Gravity Forms FreshDesk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025PDF for Elementor Forms + Drag And Drop Template Builder: Deserialization of Untrusted DataCVE-2025-60084 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in add-ons.org PDF for Elementor Forms + Drag And Drop Template Builder pdf-for-elementor-forms allows Object Injection.This issue affects PDF for Elementor Forms + Drag And Drop Template Builder: from n/a through <= 6.5.0.
Product
PDF for Elementor Forms + Drag And Drop Template Builder
Affected
up to 6.5.0
What to do
Affects up to 6.5.0. Update PDF for Elementor Forms + Drag And Drop Template Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025PDF for WPForms: Deserialization of Untrusted DataCVE-2025-60082 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in add-ons.org PDF for WPForms pdf-for-wpforms allows Object Injection.This issue affects PDF for WPForms: from n/a through <= 6.5.0.
Product
PDF for WPForms
Affected
up to 6.5.0
What to do
Affects up to 6.5.0. Update PDF for WPForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025PDF for Gravity Forms + Drag And Drop Template Builder: Deserialization of Untrusted DataCVE-2025-60080 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Deserialization of Untrusted Data vulnerability in add-ons.org PDF for Gravity Forms + Drag And Drop Template Builder pdf-for-gravity-forms allows Object Injection.This issue affects PDF for Gravity Forms + Drag And Drop Template Builder: from n/a through <= 6.5.0.
Product
PDF for Gravity Forms + Drag And Drop Template Builder
Affected
up to 6.5.0
What to do
Affects up to 6.5.0. Update PDF for Gravity Forms + Drag And Drop Template Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025VikBooking Hotel Booking Engine & PMS: Insertion of Sensitive Information Into Sent DataCVE-2025-49918 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Insertion of Sensitive Information Into Sent Data vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking allows Retrieve Embedded Sensitive Data.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through <= 1.8.2.
Product
VikBooking Hotel Booking Engine & PMS
Affected
up to 1.8.2
What to do
Affects up to 1.8.2. Update VikBooking Hotel Booking Engine & PMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 17, 2025Ninja Forms – The Contact Form Builder That Grows With You: Insecure Direct Object ReferenceCVE-2025-11924 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.13.2. This is due to the plugin not properly verifying that a user is authorized before the `ninja-forms-views` REST endpoints return form metadata and submission content. This makes it possible for unauthenticated attackers to read arbitrary form definitions and submission records via a leaked bearer token granted they can load any page containing the Submissions Table block. NOTE: The developer released a patch for this issue in 3.13.1, but inadvertently introduced a REST API endpoint in which a valid bearer token could be minted for arbitrary form IDs, making this patch ineffective.
Product
Ninja Forms – The Contact Form Builder That Grows With You
Affected
up to 3.13.2
What to do
Affects up to 3.13.2. Update Ninja Forms – The Contact Form Builder That Grows With You to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 17, 2025HTML Forms – Simple WordPress Forms: Unauthenticated Stored Cross-Site ScriptingCVE-2025-13861 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The HTML Forms – Simple WordPress Forms Plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.0 due to insufficient sanitization of fabricated file upload field metadata before displaying it in the WordPress admin dashboard. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute whenever an administrator accesses the form submissions page.
Product
HTML Forms – Simple WordPress Forms
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update HTML Forms – Simple WordPress Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 16, 2025LearnPress – WordPress LMS: Unauthorized access of dataCVE-2025-13956 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the statistic function in all versions up to, and including, 4.3.1. This makes it possible for unauthenticated attackers to view the plugin's orders statistics, including total revenue summaries and order status counts
Product
LearnPress – WordPress LMS
Affected
up to 4.3.1
What to do
Affects up to 4.3.1. Update LearnPress – WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 15, 2025LearnPress – WordPress LMS: Stored Cross-Site ScriptingCVE-2025-14387 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
LearnPress – WordPress LMS
Affected
up to 4.3.1
What to do
Affects up to 4.3.1. Update LearnPress – WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordfence.com
Dec 15, 2025Fox LMS – WordPress LMS: Privilege escalationCVE-2025-14156 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Fox LMS – WordPress LMS Plugin plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.0.5.1. This is due to the plugin not properly validating the 'role' parameter when creating new users via the `/fox-lms/v1/payments/create-order` REST API endpoint. This makes it possible for unauthenticated attackers to create new user accounts with arbitrary roles, including administrator, leading to complete site compromise.
Product
Fox LMS – WordPress LMS
Affected
up to 1.0.5.1
What to do
Affects up to 1.0.5.1. Update Fox LMS – WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 15, 2025RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login: Stored Cross-Site ScriptingCVE-2025-13610 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'RM_Forms' shortcode in all versions up to, and including, 6.0.6.7 due to insufficient input sanitization and output escaping on the 'theme' attribute. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
Affected
up to 6.0.6.7
What to do
Affects up to 6.0.6.7. Update RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 13, 2025Devs CRM – Manage tasks, attendance and teams all together: Unauthorized modification of dataCVE-2025-13093 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Devs CRM – Manage tasks, attendance and teams all together plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/devs-crm/v1/bulk-update' REST-API endpoint in all versions up to, and including, 1.1.8. This makes it possible for unauthenticated attackers to update leads tags.
Product
Devs CRM – Manage tasks, attendance and teams all together
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update Devs CRM – Manage tasks, attendance and teams all together to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Dec 13, 2025Devs CRM – Manage tasks, attendance and teams all together: Unauthorized access of dataCVE-2025-13092 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Devs CRM – Manage tasks, attendance and teams all together plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /wp-json/devs-crm/v1/attendances REST API Endpoint in all versions up to, and including, 1.1.8. This makes it possible for unauthenticated attackers to retrieve private user data, including password hashes.
Product
Devs CRM – Manage tasks, attendance and teams all together
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update Devs CRM – Manage tasks, attendance and teams all together to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Dec 13, 2025افزونه پیامک ووکامرس فوق حرفه ای (جدید) payamito sms woocommerce: Time-based blind SQL InjectionCVE-2025-13077 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The افزونه پیامک ووکامرس فوق حرفه ای (جدید) payamito sms woocommerce plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'columns' parameter in all versions up to, and including, 1.3.5. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
افزونه پیامک ووکامرس فوق حرفه ای (جدید) payamito sms woocommerce
Affected
up to 1.3.5
What to do
Affects up to 1.3.5. Update افزونه پیامک ووکامرس فوق حرفه ای (جدید) payamito sms woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record owasp.org plugins.trac.wordpress.org
Dec 12, 2025MailerLite – Signup forms (official): Stored Cross-Site ScriptingCVE-2025-13993 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_description' and 'success_message' parameters in versions up to, and including, 1.7.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
MailerLite – Signup forms (official)
Affected
up to 1.7.16
What to do
Affects up to 1.7.16. Update MailerLite – Signup forms (official) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 12, 2025VikRentItems Flexible Rental Management System: Reflected Cross-Site ScriptingCVE-2025-14049 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The VikRentItems Flexible Rental Management System plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'delto' parameter in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
VikRentItems Flexible Rental Management System
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update VikRentItems Flexible Rental Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 11, 2025Multi Uploader for Gravity Forms: Arbitrary file deletionCVE-2025-14344 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'plupload_ajax_delete_file' function in all versions up to, and including, 1.1.7. This makes it possible for unauthenticated attackers to delete arbitrary files on the server.
Product
Multi Uploader for Gravity Forms
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update Multi Uploader for Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 9, 2025WP Gravity Forms FreshDesk: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-67587 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms FreshDesk Plugin gf-freshdesk allows Phishing.This issue affects WP Gravity Forms FreshDesk Plugin: from n/a through <= 1.3.5.
Product
WP Gravity Forms FreshDesk
Affected
up to 1.3.5
What to do
Affects up to 1.3.5. Update WP Gravity Forms FreshDesk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025WPForms Google Sheet Connector: Missing AuthorizationCVE-2025-67570 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WesternDeal WPForms Google Sheet Connector gsheetconnector-wpforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPForms Google Sheet Connector: from n/a through <= 4.0.0.
Product
WPForms Google Sheet Connector
Affected
up to 4.0.0
What to do
Affects up to 4.0.0. Update WPForms Google Sheet Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms: Missing AuthorizationCVE-2025-67468 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in CRM Perks Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms cf7-salesforce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms: from n/a through <= 1.4.6.
Product
Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms
Affected
up to 1.4.6
What to do
Affects up to 1.4.6. Update Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Tutor LMS Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63042 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS Elementor Addons tutor-lms-elementor-addons allows Stored XSS.This issue affects Tutor LMS Elementor Addons: from n/a through <= 3.0.1.
Product
Tutor LMS Elementor Addons
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update Tutor LMS Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025WPLMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63035 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VibeThemes WPLMS wplms_plugin allows DOM-Based XSS.This issue affects WPLMS: from n/a through <= 1.9.9.5.4.
Product
WPLMS
Affected
up to 1.9.9.5.4
What to do
Affects up to 1.9.9.5.4. Update WPLMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Formstack Online Forms: Missing AuthorizationCVE-2025-62738 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in mmattax Formstack Online Forms formstack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Formstack Online Forms: from n/a through <= 2.0.2.
Product
Formstack Online Forms
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update Formstack Online Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Create Posts & Terms: Cross-Site Request Forgery (CSRF)CVE-2025-49351 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Valentin Agachi Create Posts & Terms create-posts-terms allows Stored XSS.This issue affects Create Posts & Terms: from n/a through <= 1.3.1.
Product
Create Posts & Terms
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Create Posts & Terms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 6, 2025Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: Insecure Direct Object ReferenceCVE-2025-13748 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.1.7 via the 'submission_id' parameter due to missing validation on a user controlled key within the confirmScaPayment() function. This makes it possible for unauthenticated attackers to mark arbitrary submissions as failed via crafted requests to the endpoint granted they can guess or enumerate a valid submission identifier.
Product
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
Affected
up to 6.1.7
What to do
Affects up to 6.1.7. Update Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 2, 2025DesignThemes LMS: Privilege EscalationCVE-2025-13542 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The DesignThemes LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.4. This is due to the 'dtlms_register_user_front_end' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site.
Product
DesignThemes LMS
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update DesignThemes LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Nov 22, 2025GSheetConnector For Ninja Forms: Unauthorized access of dataCVE-2025-13136 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The GSheetConnector For Ninja Forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'njform-google-sheet-config ' page in all versions up to, and including, 2.0.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve information about the system.
Product
GSheetConnector For Ninja Forms
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update GSheetConnector For Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 21, 2025Mstoreapp Mobile App: And Mstoreapp Mobile Multivendor through 9CVE-2025-11127 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Mstoreapp Mobile App WordPress plugin through 2.08 and Mstoreapp Mobile Multivendor through 9.0.1 do not properly verify users identify when using an AJAX action, allowing unauthenticated users to retrieve a valid session for arbitrary users by knowing their email address.
Product
Mstoreapp Mobile App
Affected
up to 2.08
What to do
Affects up to 2.08. Update Mstoreapp Mobile App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 21, 2025I Order Terms: Cross-Site Request Forgery (CSRF)CVE-2025-66097 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Igor Jerosimić I Order Terms i-order-terms allows Cross Site Request Forgery.This issue affects I Order Terms: from n/a through <= 1.5.0.
Product
I Order Terms
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update I Order Terms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 21, 2025SMS Alert Order Notifications: Missing AuthorizationCVE-2025-66086 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Cozy Vision SMS Alert Order Notifications sms-alert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMS Alert Order Notifications: from n/a through <= 3.8.8.
Product
SMS Alert Order Notifications
Affected
up to 3.8.8
What to do
Affects up to 3.8.8. Update SMS Alert Order Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 21, 2025Flo Forms – Easy Drag & Drop Form Builder: Stored Cross-Site ScriptingCVE-2025-13159 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The Flo Forms – Easy Drag & Drop Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all versions up to, and including, 1.0.43. This is due to the plugin allowing SVG file uploads via an unauthenticated AJAX endpoint (`flo_form_submit`) without proper file content validation. This makes it possible for unauthenticated attackers to upload malicious SVG files containing JavaScript that executes when an administrator views the uploaded file in the WordPress admin interface, leading to potential full site compromise.
Product
Flo Forms – Easy Drag & Drop Form Builder
Affected
up to 1.0.43
What to do
Affects up to 1.0.43. Update Flo Forms – Easy Drag & Drop Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 21, 2025LearnPress – WordPress LMS: Sensitive Information DisclosureCVE-2025-11368 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 4.2.9.4. This is due to missing capability checks in the REST endpoint /wp-json/lp/v1/load_content_via_ajax which allows arbitrary callback execution of admin-only template methods. This makes it possible for unauthenticated attackers to retrieve admin curriculum HTML, quiz questions with correct answers, course materials, and other sensitive educational content via the REST API endpoint granted they can supply valid numeric IDs.
Product
LearnPress – WordPress LMS
Affected
up to 4.2.9.4
What to do
Affects up to 4.2.9.4. Update LearnPress – WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 19, 2025SureForms: Cross-Site Request Forgery BypassCVE-2025-12535 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The SureForms plugin for WordPress is vulnerable to Cross-Site Request Forgery Bypass in all versions up to, and including, 1.13.1. This is due to the plugin distributing generic WordPress REST API nonces (wp_rest) to unauthenticated users via the 'wp_ajax_nopriv_rest-nonce' action. While the plugin legitimately needs to support unauthenticated form submissions, it incorrectly uses generic REST nonces instead of form-specific nonces. This makes it possible for unauthenticated attackers to bypass CSRF protection on REST API endpoints that rely solely on nonce verification without additional authentication checks, allowing them to trigger unauthorized actions such as the plugin's own post-submission hooks and potentially other plugins' REST endpoints.
Product
SureForms
Affected
up to 1.13.1
What to do
Affects up to 1.13.1. Update SureForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 19, 2025User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor: Stored Cross-Site ScriptingCVE-2025-13054 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wppb-embed shortcode in all versions up to, and including, 3.14.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
Affected
up to 3.14.8
What to do
Affects up to 3.14.8. Update User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 18, 2025wModes – Catalog Mode, Product Pricing, Enquiry Forms & Promotions: Authorization bypassCVE-2025-12639 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The wModes – Catalog Mode, Product Pricing, Enquiry Forms & Promotions plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.2.2. This is due to the plugin not properly verifying that a user is authorized to access sensitive information via the AJAX endpoint. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract sensitive information including user emails, usernames, roles, capabilities, and WooCommerce data such as products and payment methods.
Product
wModes – Catalog Mode, Product Pricing, Enquiry Forms & Promotions
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update wModes – Catalog Mode, Product Pricing, Enquiry Forms & Promotions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 18, 2025Pie Forms for WP: Arbitrary File UploadCVE-2025-12528 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Pie Forms for WP plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6 via the format_classic function. This is due to insufficient file type validation where the validate_classic method validates file extensions and sets error messages but does not prevent the file upload process from continuing. This makes it possible for unauthenticated attackers to upload files with dangerous extensions such as PHP, which makes remote code execution possible. In order to exploit this vulnerability, the attacker needs to guess the directory in which the file is placed (which is a somewhat predictable hash). In addition to that, the file name is generated using a secure hash method, limiting the exploitability of this vulnerability.
Product
Pie Forms for WP
Affected
up to 1.6
What to do
Affects up to 1.6. Update Pie Forms for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 17, 2025Gravity Forms: Arbitrary file uploadsCVE-2025-12974 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the legacy chunked upload mechanism in all versions up to, and including, 2.9.21.1. This is due to the extension blacklist not including .phar files, which can be uploaded through the chunked upload mechanism. This makes it possible for unauthenticated attackers to upload executable .phar files and achieve remote code execution on the server, granted they can discover or enumerate the upload path. In order for an attacker to achieve RCE, the web server needs to be set up to process .phar file as PHP via file handler mapping or similar.
Product
Gravity Forms
Affected
up to 2.9.21.1
What to do
Affects up to 2.9.21.1. Update Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record docs.gravityforms.com github.com
Nov 13, 2025Popup addon for Ninja Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64264 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aman Popup addon for Ninja Forms popup-addon-for-ninja-forms allows Stored XSS.This issue affects Popup addon for Ninja Forms: from n/a through <= 3.5.1.
Product
Popup addon for Ninja Forms
Affected
up to 3.5.1
What to do
Affects up to 3.5.1. Update Popup addon for Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 13, 2025WP Headless CMS Framework: Protection mechanism bypassCVE-2025-11260 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Headless CMS Framework plugin for WordPress is vulnerable to protection mechanism bypass in all versions up to, and including, 1.15. This is due to the plugin only checking for the existence of the Authorization header in a request when determining if the nonce protection should be bypassed. This makes it possible for unauthenticated attackers to access content they should not have access to.
Product
WP Headless CMS Framework
Affected
up to 1.15
What to do
Affects up to 1.15. Update WP Headless CMS Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Nov 13, 2025Angel – Fashion Model Agency WordPress CMS: Stored Cross-Site Scripting the profile media uploaderCVE-2025-10295 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Angel – Fashion Model Agency WordPress CMS Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting the profile media uploader in all versions up to, and including, 3.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the user has access to the edit profile form with the media upload option.
Product
Angel – Fashion Model Agency WordPress CMS
Affected
up to 3.2.3
What to do
Affects up to 3.2.3. Update Angel – Fashion Model Agency WordPress CMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Nov 12, 2025SureForms: Sensitive Information ExposureCVE-2025-12536 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The SureForms plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.1 via the '_srfm_email_notification' post meta registration. This is due to setting the 'auth_callback' parameter to '__return_true', which allows unauthenticated access to the metadata. This makes it possible for unauthenticated attackers to extract sensitive data including email notification configurations, which frequently contain vendor-provided CRM/help desk dropbox addresses, CC/BCC recipients, and notification templates that can be abused to inject malicious data into downstream systems.
Product
SureForms
Affected
up to 1.13.1
What to do
Affects up to 1.13.1. Update SureForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 12, 2025LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes: Privilege escalationCVE-2025-11923 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to privilege escalation. This is due to the plugin not properly validating a user's identity prior to allowing them to modify their own role via the REST API. The permission check in the update_item_permissions_check() function returns true when a user updates their own account without verifying the role changes. This makes it possible for authenticated attackers, with student-level access and above, to escalate their privileges to administrator by updating their own roles array via a crafted REST API request. Another endpoint intended for instructors also provides an attack vector. Affected version ranges are 3.5.3-3.41.2, 4.0.0-4.21.3, 5.0.0-5.10.0, 6.0.0-6.11.0, 7.0.0-7.8.7, 8.0.0-8.0.7, 9.0.0-9.0.7, 9.1.0.
Product
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
What to do
Update LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 8, 2025Academy LMS – WordPress LMS Plugin for Complete eLearning Solution: PHP Object InjectionCVE-2025-12099 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.3.8 via deserialization of untrusted input in the 'import_all_courses' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Product
Academy LMS – WordPress LMS Plugin for Complete eLearning Solution
Affected
up to 3.3.8
What to do
Affects up to 3.3.8. Update Academy LMS – WordPress LMS Plugin for Complete eLearning Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 8, 2025Academy LMS – WordPress LMS Plugin for Complete eLearning Solution: Sensitive Information ExposureCVE-2025-12098 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.8 via the 'enqueue_social_login_script' function. This makes it possible for unauthenticated attackers to extract sensitive data including the Facebook App Secret if Facebook Social Login is enabled.
Product
Academy LMS – WordPress LMS Plugin for Complete eLearning Solution
Affected
up to 3.3.8
What to do
Affects up to 3.3.8. Update Academy LMS – WordPress LMS Plugin for Complete eLearning Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record academylms.net wordfence.com
Nov 7, 2025HTML Forms – Simple WordPress Forms: Stored Cross-Site ScriptingCVE-2025-12125 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The HTML Forms – Simple WordPress Forms Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
HTML Forms – Simple WordPress Forms
Affected
up to 1.5.5
What to do
Affects up to 1.5.5. Update HTML Forms – Simple WordPress Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 7, 2025Gravity Forms: Arbitrary file uploadsCVE-2025-12352 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the copy_post_image() function in all versions up to, and including, 2.9.20. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. This only impacts sites that have allow_url_fopen set to `On`, the post creation form enabled along with a file upload field for the post
Product
Gravity Forms
Affected
up to 2.9.20
What to do
Affects up to 2.9.20. Update Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Nov 6, 2025CoSchool LMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-60239 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Codexpert, Inc CoSchool LMS coschool allows Blind SQL Injection.This issue affects CoSchool LMS: from n/a through <= 1.4.3.
Product
CoSchool LMS
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update CoSchool LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.