Vulnerability database

2,803 results · page 16 of 57

• Jan 16, 2026Rede Itaú for WooCommerce: Order status manipulationCVE-2026-0939 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The Rede Itaú for WooCommerce plugin for WordPress is vulnerable to order status manipulation due to insufficient verification of data authenticity in all versions up to, and including, 5.1.2. This is due to the plugin failing to verify the authenticity of payment callbacks. This makes it possible for unauthenticated attackers to manipulate WooCommerce order statuses, either marking unpaid orders as paid, or failed.

  Product

  Rede Itaú for WooCommerce

  Affected

  up to 5.1.2

  What to do

  Affects up to 5.1.2. Update Rede Itaú for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jan 13, 2026Social-Share-Buttons 2.2.3 contains a critical SQL injection vulnerability in the project_id parameter that allows attackers to manipulate database queries.CVE-2023-54333 · WordPress plugins & themes · reported by VulnCheckHigh 8.8

  Social-Share-Buttons 2.2.3 contains a critical SQL injection vulnerability in the project_id parameter that allows attackers to manipulate database queries. Attackers can exploit this vulnerability by sending crafted POST requests with malicious SQL payloads to retrieve and potentially steal entire database contents.

  Product

  Social-Share-Buttons

  What to do

  Update Social-Share-Buttons to the newest version.

  Full record and what to do →NVD recordgithub.comsupsystic.com

• Jan 9, 2026Eventin – Event Manager, Events Calendar, Event Tickets and Registrations: Unauthorized modification of dataCVE-2025-14657 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The Eventin – Event Manager, Events Calendar, Event Tickets and Registrations plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'post_settings' function in all versions up to, and including, 4.0.51. This makes it possible for unauthenticated attackers to modify plugin settings. Furthermore, due to insufficient input sanitization and output escaping on the 'etn_primary_color' setting, this enables unauthenticated attackers to inject arbitrary web scripts that will execute whenever a user accesses a page where Eventin styles are loaded.

  Product

  Eventin – Event Manager, Events Calendar, Event Tickets and Registrations

  Affected

  up to 4.0.51

  What to do

  Affects up to 4.0.51. Update Eventin – Event Manager, Events Calendar, Event Tickets and Registrations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jan 8, 2026Automotive Listings: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-67928 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in themesuite Automotive Listings automotive allows Blind SQL Injection.This issue affects Automotive Listings: from n/a through <= 18.6.

  Product

  Automotive Listings

  Affected

  up to 18.6

  What to do

  Affects up to 18.6. Update Automotive Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 8, 2026Lobo: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-67921 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VanKarWai Lobo lobo allows Blind SQL Injection.This issue affects Lobo: from n/a through < 2.8.6.

  Product

  Lobo

  What to do

  Update Lobo to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jan 8, 2026Felan Framework: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-23993 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RiceTheme Felan Framework felan-framework allows SQL Injection.This issue affects Felan Framework: from n/a through <= 1.1.3.

  Product

  Felan Framework

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update Felan Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 8, 2026Workreap (theme's plugin): Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22728 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech Workreap (theme's plugin) workreap allows SQL Injection.This issue affects Workreap (theme's plugin): from n/a through <= 3.3.6.

  Product

  Workreap (theme's plugin)

  Affected

  up to 3.3.6

  What to do

  Affects up to 3.3.6. Update Workreap (theme's plugin) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 8, 2026WooCommerce Orders & Customers Exporter: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22713 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in vanquish WooCommerce Orders & Customers Exporter woocommerce-orders-ei allows SQL Injection.This issue affects WooCommerce Orders & Customers Exporter: from n/a through <= 5.4.

  Product

  WooCommerce Orders & Customers Exporter

  Affected

  up to 5.4

  What to do

  Affects up to 5.4. Update WooCommerce Orders & Customers Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2026Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager: Unauthorized Arbitrary Media ReplacementCVE-2025-12640 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vulnerable to Unauthorized Arbitrary Media Replacement in all versions up to, and including, 3.1.5. This is due to missing object-level authorization checks in the handle_folders_file_upload() function. This makes it possible for authenticated attackers, with Author-level access and above, to replace arbitrary media files from the WordPress Media Library.

  Product

  Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager

  Affected

  up to 3.1.5

  What to do

  Affects up to 3.1.5. Update Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Jan 7, 2026WPCHURCH: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32303 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mojoomla WPCHURCH allows Blind SQL Injection.This issue affects WPCHURCH: from n/a through 2.7.0.

  Product

  WPCHURCH

  Affected

  up to 2.7.0

  What to do

  Affects up to 2.7.0. Update WPCHURCH to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2026Frontend File Manager: Did not validate a path parameter and ownership of the fileCVE-2025-14804 · WordPress plugins & themes · reported by WPScanHigh 7.7

  The Frontend File Manager Plugin WordPress plugin before 23.5 did not validate a path parameter and ownership of the file, allowing any authenticated users, such as subscribers to delete arbitrary files on the server

  Product

  Frontend File Manager

  Fixed in

  23.5

  What to do

  Update Frontend File Manager to 23.5 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Jan 7, 2026WP Recipe Manager: Stored Cross-Site ScriptingCVE-2025-13667 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The WP Recipe Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Skill Level' input field in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  WP Recipe Manager

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update WP Recipe Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jan 7, 2026Premmerce WooCommerce Customers Manager: Reflected Cross-Site ScriptingCVE-2025-13369 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The Premmerce WooCommerce Customers Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'money_spent_from', 'money_spent_to', 'registered_from', and 'registered_to' parameters in all versions up to, and including, 1.1.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link.

  Product

  Premmerce WooCommerce Customers Manager

  Affected

  up to 1.1.14

  What to do

  Affects up to 1.1.14. Update Premmerce WooCommerce Customers Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jan 6, 2026Ninja Tables: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-69351 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjahan Jewel Ninja Tables ninja-tables allows Blind SQL Injection.This issue affects Ninja Tables: from n/a through <= 5.2.4.

  Product

  Ninja Tables

  Affected

  up to 5.2.4

  What to do

  Affects up to 5.2.4. Update Ninja Tables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 6, 2026Car Rental Manager: Missing AuthorizationCVE-2025-69327 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in magepeopleteam Car Rental Manager car-rental-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Car Rental Manager: from n/a through <= 1.0.9.

  Product

  Car Rental Manager

  Affected

  up to 1.0.9

  What to do

  Affects up to 1.0.9. Update Car Rental Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 6, 2026AdsPlace'r – Ad Manager, Inserter, AdSense Ads: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-31088 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPShop.Ru AdsPlace'r – Ad Manager, Inserter, AdSense Ads allows DOM-Based XSS.This issue affects AdsPlace'r – Ad Manager, Inserter, AdSense Ads: from n/a through 1.1.5.

  Product

  AdsPlace'r – Ad Manager, Inserter, AdSense Ads

  Affected

  up to 1.1.5

  What to do

  Affects up to 1.1.5. Update AdsPlace'r – Ad Manager, Inserter, AdSense Ads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 6, 2026Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI: Unauthorized modification of dataCVE-2025-14371 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the taxopress_ai_add_post_term function in all versions up to, and including, 3.41.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to add or remove taxonomy terms (tags, categories) on any post, including ones they do not own.

  Product

  Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI

  Affected

  up to 3.41.0

  What to do

  Affects up to 3.41.0. Update Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgresearch.cleantalk.org

• Jan 5, 2026Form Vibes – Database Manager for Forms: SQL InjectionCVE-2025-13409 · WordPress plugins & themes · reported by WordfenceMedium 4.9

  The Form Vibes – Database Manager for Forms plugin for WordPress is vulnerable to SQL Injection via the 'params' parameter in all versions up to, and including, 1.4.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

  Product

  Form Vibes – Database Manager for Forms

  Affected

  up to 1.4.13

  What to do

  Affects up to 1.4.13. Update Form Vibes – Database Manager for Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jan 5, 2026Download Manager: Privilege escalationCVE-2025-15364 · WordPress plugins & themes · reported by WordfenceHigh 7.3

  The Download Manager plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.3.40. This is due to the plugin not properly validating a user's identity prior to updating their details like password. This makes it possible for unauthenticated attackers to change user's passwords, except administrators, and leverage that to gain access to their account.

  Product

  Download Manager

  Affected

  up to 3.3.40

  What to do

  Affects up to 3.3.40. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jan 5, 2026Entrada: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-39484 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Waituk Entrada allows SQL Injection.This issue affects Entrada: from n/a through 5.7.7.

  Product

  Entrada

  Affected

  up to 5.7.7

  What to do

  Affects up to 5.7.7. Update Entrada to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 5, 2026iPhone Webclip Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53735 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in corourke iPhone Webclip Manager iphone-webclip-manager allows Stored XSS.This issue affects iPhone Webclip Manager: from n/a through <= 0.5.

  Product

  iPhone Webclip Manager

  Affected

  up to 0.5

  What to do

  Affects up to 0.5. Update iPhone Webclip Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 5, 2026WP Job Manager: Cross-Site Request Forgery (CSRF)CVE-2023-52212 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Automattic WP Job Manager allows Cross Site Request Forgery.This issue affects WP Job Manager: from n/a through 2.0.0.

  Product

  WP Job Manager

  Affected

  up to 2.0.0

  What to do

  Affects up to 2.0.0. Update WP Job Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordvdp.patchstack.com

• Jan 5, 2026Infility Global: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68865 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Infility Infility Global infility-global allows SQL Injection.This issue affects Infility Global: from n/a through <= 2.15.06.

  Product

  Infility Global

  Affected

  up to 2.15.06

  What to do

  Affects up to 2.15.06. Update Infility Global to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 5, 2026Premium SEO Pack: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31044 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team Premium SEO Pack allows SQL Injection.This issue affects Premium SEO Pack: from n/a through 3.3.2.

  Product

  Premium SEO Pack

  Affected

  up to 3.3.2

  What to do

  Affects up to 3.3.2. Update Premium SEO Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 5, 2026Amazon Native Shopping Recommendations: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30633 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team Amazon Native Shopping Recommendations allows SQL Injection.This issue affects Amazon Native Shopping Recommendations: from n/a through 1.3.

  Product

  Amazon Native Shopping Recommendations

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Amazon Native Shopping Recommendations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer): Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30628 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) allows SQL Injection.This issue affects Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer): from n/a through 1.2.

  Product

  Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer)

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Mediabay - WordPress Media Library Folders: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-28949 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Codedraft Mediabay - WordPress Media Library Folders allows Blind SQL Injection.This issue affects Mediabay - WordPress Media Library Folders: from n/a through 1.4.

  Product

  Mediabay - WordPress Media Library Folders

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Mediabay - WordPress Media Library Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Behance Portfolio Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-59135 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eleopard Behance Portfolio Manager portfolio-manager-powered-by-behance allows Stored XSS.This issue affects Behance Portfolio Manager: from n/a through <= 1.7.5.

  Product

  Behance Portfolio Manager

  Affected

  up to 1.7.5

  What to do

  Affects up to 1.7.5. Update Behance Portfolio Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025WebMan Amplifier: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62757 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebMan Design | Oliver Juhas WebMan Amplifier webman-amplifier allows DOM-Based XSS.This issue affects WebMan Amplifier: from n/a through <= 1.5.12.

  Product

  WebMan Amplifier

  Affected

  up to 1.5.12

  What to do

  Affects up to 1.5.12. Update WebMan Amplifier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Sermon Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63000 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpforchurch Sermon Manager sermon-manager-for-wordpress allows Stored XSS.This issue affects Sermon Manager: from n/a through <= 2.30.0.

  Product

  Sermon Manager

  Affected

  up to 2.30.0

  What to do

  Affects up to 2.30.0. Update Sermon Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Behance Portfolio Manager: Cross-Site Request Forgery (CSRF)CVE-2025-59137 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in eleopard Behance Portfolio Manager portfolio-manager-powered-by-behance allows Stored XSS.This issue affects Behance Portfolio Manager: from n/a through <= 1.7.5.

  Product

  Behance Portfolio Manager

  Affected

  up to 1.7.5

  What to do

  Affects up to 1.7.5. Update Behance Portfolio Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 30, 2025Appointify: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-59129 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in appointify Appointify appointify allows Blind SQL Injection.This issue affects Appointify: from n/a through <= 1.0.8.

  Product

  Appointify

  Affected

  up to 1.0.8

  What to do

  Affects up to 1.0.8. Update Appointify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 30, 2025HR Management Lite: Missing AuthorizationCVE-2025-69022 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in Weblizar - WordPress Themes & Plugin HR Management Lite hr-management-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HR Management Lite: from n/a through <= 3.6.

  Product

  HR Management Lite

  Affected

  up to 3.6

  What to do

  Affects up to 3.6. Update HR Management Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 30, 2025BWL Knowledge Base Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68992 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xenioushk BWL Knowledge Base Manager bwl-kb-manager allows Stored XSS.This issue affects BWL Knowledge Base Manager: from n/a through <= 1.6.3.

  Product

  BWL Knowledge Base Manager

  Affected

  up to 1.6.3

  What to do

  Affects up to 1.6.3. Update BWL Knowledge Base Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 30, 2025BWL Pro Voting Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68991 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xenioushk BWL Pro Voting Manager bwl-pro-voting-manager allows DOM-Based XSS.This issue affects BWL Pro Voting Manager: from n/a through <= 1.4.9.

  Product

  BWL Pro Voting Manager

  Affected

  up to 1.4.9

  What to do

  Affects up to 1.4.9. Update BWL Pro Voting Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 30, 2025BWL Pro Voting Manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68990 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in xenioushk BWL Pro Voting Manager bwl-pro-voting-manager allows Blind SQL Injection.This issue affects BWL Pro Voting Manager: from n/a through <= 1.4.9.

  Product

  BWL Pro Voting Manager

  Affected

  up to 1.4.9

  What to do

  Affects up to 1.4.9. Update BWL Pro Voting Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 29, 2025WP Project Manager: Insertion of Sensitive Information Into Sent DataCVE-2025-68040 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Insertion of Sensitive Information Into Sent Data vulnerability in weDevs WP Project Manager wedevs-project-manager allows Retrieve Embedded Sensitive Data.This issue affects WP Project Manager: from n/a through <= 3.0.1.

  Product

  WP Project Manager

  Affected

  up to 3.0.1

  What to do

  Affects up to 3.0.1. Update WP Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 25, 2025Frontend Post Submission Manager Lite – Frontend Posting: Unauthorized loss of dataCVE-2025-14913 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to an incorrect authorization check on the 'media_delete_action' function in all versions up to, and including, 1.2.6. This makes it possible for unauthenticated attackers to delete arbitrary attachments.

  Product

  Frontend Post Submission Manager Lite – Frontend Posting

  Affected

  up to 1.2.6

  What to do

  Affects up to 1.2.6. Update Frontend Post Submission Manager Lite – Frontend Posting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Dec 24, 2025Integration for Contact Form 7 HubSpot: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68590 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CRM Perks Integration for Contact Form 7 HubSpot cf7-hubspot allows Blind SQL Injection.This issue affects Integration for Contact Form 7 HubSpot: from n/a through <= 1.4.2.

  Product

  Integration for Contact Form 7 HubSpot

  Affected

  up to 1.4.2

  What to do

  Affects up to 1.4.2. Update Integration for Contact Form 7 HubSpot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 24, 2025SALESmanago & Leadoo: Missing AuthorizationCVE-2025-68571 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in SALESmanago SALESmanago & Leadoo salesmanago allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SALESmanago & Leadoo: from n/a through <= 3.9.0.

  Product

  SALESmanago & Leadoo

  Affected

  up to 3.9.0

  What to do

  Affects up to 3.9.0. Update SALESmanago & Leadoo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 24, 2025Captivate Sync: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68570 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in captivateaudio Captivate Sync captivatesync-trade allows Blind SQL Injection.This issue affects Captivate Sync: from n/a through <= 3.2.2.

  Product

  Captivate Sync

  Affected

  up to 3.2.2

  What to do

  Affects up to 3.2.2. Update Captivate Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 24, 2025Brands for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68519 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BeRocket Brands for WooCommerce brands-for-woocommerce allows Blind SQL Injection.This issue affects Brands for WooCommerce: from n/a through <= 3.8.6.3.

  Product

  Brands for WooCommerce

  Affected

  up to 3.8.6.3

  What to do

  Affects up to 3.8.6.3. Update Brands for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 24, 2025User Feedback: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68496 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Syed Balkhi User Feedback userfeedback-lite allows Blind SQL Injection.This issue affects User Feedback: from n/a through <= 1.10.0.

  Product

  User Feedback

  Affected

  up to 1.10.0

  What to do

  Affects up to 1.10.0. Update User Feedback to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 24, 2025WPJobBoard: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-36525 · WordPress plugins & themes · reported by PatchstackHigh 8.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPJobBoard allows Blind SQL Injection.This issue affects WPJobBoard: from n/a through 5.9.0.

  Product

  WPJobBoard

  Affected

  up to 5.9.0

  What to do

  Affects up to 5.9.0. Update WPJobBoard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordvdp.patchstack.com

• Dec 23, 2025AutomatorWP: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68561 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia AutomatorWP automatorwp allows SQL Injection.This issue affects AutomatorWP: from n/a through <= 5.2.4.

  Product

  AutomatorWP

  Affected

  up to 5.2.4

  What to do

  Affects up to 5.2.4. Update AutomatorWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 23, 2025WPBulky: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68550 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VillaTheme WPBulky wpbulky-wp-bulk-edit-post-types allows Blind SQL Injection.This issue affects WPBulky: from n/a through <= 1.1.13.

  Product

  WPBulky

  Affected

  up to 1.1.13

  What to do

  Affects up to 1.1.13. Update WPBulky to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 20, 2025Frontend Post Submission Manager Lite: Missing AuthorizationCVE-2025-14080 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The Frontend Post Submission Manager Lite plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.2.5. This is due to missing authorization checks on the post update functionality in the fpsml_form_process AJAX action. This makes it possible for unauthenticated attackers to modify arbitrary posts by providing a post_id parameter via the guest posting form, allowing them to change post titles, content, excerpts, and remove post authors.

  Product

  Frontend Post Submission Manager Lite

  Affected

  up to 1.2.5

  What to do

  Affects up to 1.2.5. Update Frontend Post Submission Manager Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Dec 19, 2025myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program: Missing AuthorizationCVE-2025-12361 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.9.7.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive information including user IDs, display names, and email addresses of all users on the site via the get_bank_accounts AJAX action. Passwords are not exposed.

  Product

  myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program

  Affected

  up to 2.9.7.1

  What to do

  Affects up to 2.9.7.1. Update myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Dec 18, 2025Sermon Manager: Missing AuthorizationCVE-2025-63002 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in wpforchurch Sermon Manager sermon-manager-for-wordpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sermon Manager: from n/a through <= 2.30.0.

  Product

  Sermon Manager

  Affected

  up to 2.30.0

  What to do

  Affects up to 2.30.0. Update Sermon Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025Hummingbird Performance: Sensitive Information ExposureCVE-2025-14437 · WordPress plugins & themes · reported by WordfenceHigh 7.5

  The Hummingbird Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.18.0 via the 'request' function. This makes it possible for unauthenticated attackers to extract sensitive data including Cloudflare API credentials.

  Product

  Hummingbird Performance

  Affected

  up to 3.18.0

  What to do

  Affects up to 3.18.0. Update Hummingbird Performance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.